1. 07 Jul, 2016 1 commit
    • Michal Kubecek's avatar
      ipvs: count pre-established TCP states as active · be2cef49
      Michal Kubecek authored
      Some users observed that "least connection" distribution algorithm doesn't
      handle well bursts of TCP connections from reconnecting clients after
      a node or network failure.
      
      This is because the algorithm counts active connection as worth 256
      inactive ones where for TCP, "active" only means TCP connections in
      ESTABLISHED state. In case of a connection burst, new connections are
      handled before previous ones have finished the three way handshaking so
      that all are still counted as "inactive", i.e. cheap ones. The become
      "active" quickly but at that time, all of them are already assigned to one
      real server (or few), resulting in highly unbalanced distribution.
      
      Address this by counting the "pre-established" states as "active".
      Signed-off-by: default avatarMichal Kubecek <mkubecek@suse.cz>
      Acked-by: default avatarJulian Anastasov <ja@ssi.bg>
      Signed-off-by: default avatarSimon Horman <horms@verge.net.au>
      be2cef49
  2. 05 Jul, 2016 1 commit
    • Pavel Tikhomirov's avatar
      netfilter: nf_log: fix error on write NONE to logger choice sysctl · c6ac37d8
      Pavel Tikhomirov authored
      It is hard to unbind nf-logger:
      
        echo NONE > /proc/sys/net/netfilter/nf_log/0
        bash: echo: write error: No such file or directory
      
        sysctl -w net.netfilter.nf_log.0=NONE
        sysctl: setting key "net.netfilter.nf_log.0": No such file or directory
        net.netfilter.nf_log.0 = NONE
      
      You need explicitly send '\0', for instance like:
      
        echo -e "NONE\0" > /proc/sys/net/netfilter/nf_log/0
      
      That seem to be strange, so fix it using proc_dostring.
      
      Now it works fine:
         modprobe nfnetlink_log
         echo nfnetlink_log > /proc/sys/net/netfilter/nf_log/0
         cat /proc/sys/net/netfilter/nf_log/0
         nfnetlink_log
         echo NONE > /proc/sys/net/netfilter/nf_log/0
         cat /proc/sys/net/netfilter/nf_log/0
         NONE
      
      v2: add missed error check for proc_dostring
      Signed-off-by: default avatarPavel Tikhomirov <ptikhomirov@virtuozzo.com>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      c6ac37d8
  3. 03 Jul, 2016 1 commit
    • Joe Perches's avatar
      netfilter: Convert FWINV<[foo]> macros and uses to NF_INVF · c37a2dfa
      Joe Perches authored
      netfilter uses multiple FWINV #defines with identical form that hide a
      specific structure variable and dereference it with a invflags member.
      
      $ git grep "#define FWINV"
      include/linux/netfilter_bridge/ebtables.h:#define FWINV(bool,invflg) ((bool) ^ !!(info->invflags & invflg))
      net/bridge/netfilter/ebtables.c:#define FWINV2(bool, invflg) ((bool) ^ !!(e->invflags & invflg))
      net/ipv4/netfilter/arp_tables.c:#define FWINV(bool, invflg) ((bool) ^ !!(arpinfo->invflags & (invflg)))
      net/ipv4/netfilter/ip_tables.c:#define FWINV(bool, invflg) ((bool) ^ !!(ipinfo->invflags & (invflg)))
      net/ipv6/netfilter/ip6_tables.c:#define FWINV(bool, invflg) ((bool) ^ !!(ip6info->invflags & (invflg)))
      net/netfilter/xt_tcpudp.c:#define FWINVTCP(bool, invflg) ((bool) ^ !!(tcpinfo->invflags & (invflg)))
      
      Consolidate these macros into a single NF_INVF macro.
      
      Miscellanea:
      
      o Neaten the alignment around these uses
      o A few lines are > 80 columns for intelligibility
      Signed-off-by: default avatarJoe Perches <joe@perches.com>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      c37a2dfa
  4. 01 Jul, 2016 3 commits
  5. 24 Jun, 2016 11 commits
  6. 23 Jun, 2016 8 commits
  7. 07 Jun, 2016 2 commits
  8. 06 Jun, 2016 11 commits
    • David S. Miller's avatar
      Merge branch 'vrf-local' · 2fb7ea45
      David S. Miller authored
      David Ahern says:
      
      ====================
      net: vrf: Add support for local traffic to local addresses
      
      Add support for locally originated traffic to VRF-local addresses,
      be it addresses on enslaved devices or addresses on the VRF device:
      
      $ ip addr show dev red
      33: red: <NOARP,MASTER,UP,LOWER_UP> mtu 65536 qdisc pfifo_fast state UP group default qlen 1000
          link/ether be:00:53:b5:e4:25 brd ff:ff:ff:ff:ff:ff
          inet 1.1.1.1/32 scope global red
             valid_lft forever preferred_lft forever
          inet6 1111:1::1/128 scope global
             valid_lft forever preferred_lft forever
      
      $ ip addr show dev eth1
      3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master red state UP group default qlen 1000
          link/ether 02:e0:f9:79:34:bd brd ff:ff:ff:ff:ff:ff
          inet 10.100.1.1/24 brd 10.100.1.255 scope global eth1
             valid_lft forever preferred_lft forever
          inet6 2100:1::1/120 scope global
             valid_lft forever preferred_lft forever
          inet6 fe80::e0:f9ff:fe79:34bd/64 scope link
             valid_lft forever preferred_lft forever
      
      $ ping -c1 -I red 10.100.1.1
          ping: Warning: source address might be selected on device other than red.
          PING 10.100.1.1 (10.100.1.1) from 10.100.1.1 red: 56(84) bytes of data.
          64 bytes from 10.100.1.1: icmp_seq=1 ttl=64 time=0.057 ms
      
      $ ping -c1 -I red 1.1.1.1
      PING 1.1.1.1 (1.1.1.1) from 1.1.1.1 red: 56(84) bytes of data.
      64 bytes from 1.1.1.1: icmp_seq=1 ttl=64 time=0.136 ms
      
      --- 1.1.1.1 ping statistics ---
      1 packets transmitted, 1 received, 0% packet loss, time 0ms
      rtt min/avg/max/mdev = 0.136/0.136/0.136/0.000 ms
      
      $ ping6 -c1 -I red  2100:1::1
      ping6: Warning: source address might be selected on device other than red.
      PING 2100:1::1(2100:1::1) from 2100:1::1 red: 56 data bytes
      64 bytes from 2100:1::1: icmp_seq=1 ttl=64 time=0.167 ms
      
      --- 2100:1::1 ping statistics ---
      1 packets transmitted, 1 received, 0% packet loss, time 0ms
      rtt min/avg/max/mdev = 0.167/0.167/0.167/0.000 ms
      
      $ ping6 -c1 -I red 1111::1
      PING 1111::1(1111::1) from 1111:1::1 red: 56 data bytes
      64 bytes from 1111::1: icmp_seq=1 ttl=64 time=0.187 ms
      
      --- 1111::1 ping statistics ---
      1 packets transmitted, 1 received, 0% packet loss, time 0ms
      rtt min/avg/max/mdev = 0.187/0.187/0.187/0.000 ms
      
      This change also enables use of loopback address on the VRF device:
      $ ip addr add dev red 127.0.0.1/8
      
      $ ping -c1 -I red 127.0.0.1
      PING 127.0.0.1 (127.0.0.1) from 127.0.0.1 red: 56(84) bytes of data.
      64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.058 ms
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2fb7ea45
    • David Ahern's avatar
      net: vrf: ipv6 support for local traffic to local addresses · 625b47b5
      David Ahern authored
      Add support for locally originated traffic to VRF-local IPv6 addresses.
      Similar to IPv4 a local dst is set on the skb and the packet is
      reinserted with a call to netif_rx. With this patch, ping, tcp and udp
      packets to a local IPv6 address are successfully routed:
      
          $ ip addr show dev eth1
          4: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master red state UP group default qlen 1000
              link/ether 02:e0:f9:1c:b9:74 brd ff:ff:ff:ff:ff:ff
              inet 10.100.1.1/24 brd 10.100.1.255 scope global eth1
                 valid_lft forever preferred_lft forever
              inet6 2100:1::1/120 scope global
                 valid_lft forever preferred_lft forever
              inet6 fe80::e0:f9ff:fe1c:b974/64 scope link
                 valid_lft forever preferred_lft forever
      
          $ ping6 -c1 -I red 2100:1::1
          ping6: Warning: source address might be selected on device other than red.
          PING 2100:1::1(2100:1::1) from 2100:1::1 red: 56 data bytes
          64 bytes from 2100:1::1: icmp_seq=1 ttl=64 time=0.098 ms
      
      ip6_input is exported so the VRF driver can use it for the dst input
      function. The dst_alloc function for IPv4 defaults to setting the input and
      output functions; IPv6's does not. VRF does not need to duplicate the Rx path
      so just export the ipv6 input function.
      Signed-off-by: default avatarDavid Ahern <dsa@cumulusnetworks.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      625b47b5
    • David Ahern's avatar
      net: vrf: ipv4 support for local traffic to local addresses · 671cd19a
      David Ahern authored
      Add support for locally originated traffic to VRF-local addresses. If
      destination device for an skb is the loopback or VRF device then set
      its dst to a local version of the VRF cached dst_entry and call netif_rx
      to insert the packet onto the rx queue - similar to what is done for
      loopback. This patch handles IPv4 support; follow on patch handles IPv6.
      
      With this patch, ping, tcp and udp packets to a local IPv4 address are
      successfully routed:
      
          $ ip addr show dev eth1
          4: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master red state UP group default qlen 1000
              link/ether 02:e0:f9:1c:b9:74 brd ff:ff:ff:ff:ff:ff
              inet 10.100.1.1/24 brd 10.100.1.255 scope global eth1
                 valid_lft forever preferred_lft forever
              inet6 2100:1::1/120 scope global
                 valid_lft forever preferred_lft forever
              inet6 fe80::e0:f9ff:fe1c:b974/64 scope link
                 valid_lft forever preferred_lft forever
      
          $ ping -c1 -I red 10.100.1.1
          ping: Warning: source address might be selected on device other than red.
          PING 10.100.1.1 (10.100.1.1) from 10.100.1.1 red: 56(84) bytes of data.
          64 bytes from 10.100.1.1: icmp_seq=1 ttl=64 time=0.057 ms
      
      This patch also enables use of IPv4 loopback address on the VRF device:
          $ ip addr add dev red 127.0.0.1/8
      
          $ ping -c1 -I red 127.0.0.1
          PING 127.0.0.1 (127.0.0.1) from 127.0.0.1 red: 56(84) bytes of data.
          64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.058 ms
      Signed-off-by: default avatarDavid Ahern <dsa@cumulusnetworks.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      671cd19a
    • David Ahern's avatar
      net: vrf: Minor refactoring for local address patches · 09fcf916
      David Ahern authored
      Move the stripping of the ethernet header from is_ip_tx_frame into the
      ipv4 and ipv6 outbound functions. If the packet is destined to a local
      address the header is retained since the packet is sent back to netif_rx.
      
      Collapse vrf_send_v4_prep into vrf_process_v4_outbound.
      Signed-off-by: default avatarDavid Ahern <dsa@cumulusnetworks.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      09fcf916
    • David S. Miller's avatar
      Merge branch 'hv_netvsc-cleanups' · b94eb2ce
      David S. Miller authored
      Vitaly Kuznetsov says:
      
      ====================
      hv_netvsc: cleanup after untangling the pointer mess
      
      Changes since v1:
      - resend when net-next is open [David Miller]
      - rebased to current net-next.
      
      After we made traveling through our internal structures explicit it became
      obvious that some functions take arguments they don't need just to do
      redundant pointer travel and get to what they really need while their
      callers already have the required information.
      
      This is just a cleanup series with no functional changes intended. It
      doesn't pretend to be complete, additional cleanup of other functions may
      follow.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b94eb2ce
    • Vitaly Kuznetsov's avatar
      hv_netvsc: pass struct net_device to rndis_filter_set_offload_params() · 426d9541
      Vitaly Kuznetsov authored
      The only caller rndis_filter_device_add() has 'struct net_device' pointer
      already.
      Signed-off-by: default avatarVitaly Kuznetsov <vkuznets@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      426d9541
    • Vitaly Kuznetsov's avatar
      hv_netvsc: pass struct net_device to rndis_filter_set_device_mac() · e834da9a
      Vitaly Kuznetsov authored
      We unpack 'struct net_device' in netvsc_set_mac_addr() to get to
      'struct hv_device' pointer which we use in rndis_filter_set_device_mac()
      to get back to 'struct net_device'.
      Signed-off-by: default avatarVitaly Kuznetsov <vkuznets@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      e834da9a
    • Vitaly Kuznetsov's avatar
      hv_netvsc: pass struct netvsc_device to rndis_filter_{open, close}() · 2f5fa6c8
      Vitaly Kuznetsov authored
      Both rndis_filter_open()/rndis_filter_close() use struct hv_device to
      reach to struct netvsc_device only and all callers have it already.
      While on it, rename net_device to nvdev in rndis_filter_open() as
      net_device is misleading.
      Signed-off-by: default avatarVitaly Kuznetsov <vkuznets@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2f5fa6c8
    • Vitaly Kuznetsov's avatar
      hv_netvsc: introduce {net, hv}_device_to_netvsc_device() helpers · 2625466d
      Vitaly Kuznetsov authored
      Make it easier to get 'struct netvsc_device' from 'struct net_device' and
      'struct hv_device' by introducing inline helpers.
      Signed-off-by: default avatarVitaly Kuznetsov <vkuznets@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2625466d
    • Vitaly Kuznetsov's avatar
      hv_netvsc: remove redundant assignment in netvsc_recv_callback() · 4baa994d
      Vitaly Kuznetsov authored
      net_device_ctx is assigned in the very beginning of the function and 'net'
      pointer doesn't change.
      Signed-off-by: default avatarVitaly Kuznetsov <vkuznets@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4baa994d
    • Michal Kubeček's avatar
      net: disable fragment reassembly if high_thresh is zero · 30759219
      Michal Kubeček authored
      Before commit 6d7b857d ("net: use lib/percpu_counter API for
      fragmentation mem accounting"), setting the reassembly high threshold
      to 0 prevented fragment reassembly as first fragment would be always
      evicted before second could be added to the queue. While inefficient,
      some users apparently relied on this method.
      
      Since the commit mentioned above, a percpu counter is used for
      reassembly memory accounting and high batch size avoids taking slow path
      in most common scenarios. As a result, a whole full sized packet can be
      reassembled without the percpu counter's main counter changing its value
      so that even with high_thresh set to 0, fragmented packets can be still
      reassembled and processed.
      
      Add explicit check preventing reassembly if high threshold is zero.
      Signed-off-by: default avatarMichal Kubecek <mkubecek@suse.cz>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      30759219
  9. 05 Jun, 2016 2 commits
    • David S. Miller's avatar
      Merge branch 'hns-acpi' · b1c6a3a4
      David S. Miller authored
      Kejian Yan says:
      
      ====================
      net: hns: add support of ACPI
      
      This series adds HNS support of acpi. The routine will call some ACPI
      helper functions, like acpi_dev_found() and acpi_evaluate_dsm(), which
      are not included in other cases. In order to make system compile
      successfully in other cases except ACPI, it needs to add relative stub
      functions to linux/acpi.h. And we use device property functions instead
      of serial helper functions to suport both DT and ACPI cases. And then
      add the supports of ACPI for HNS.
      
      change log:
       v3->v4:
        mii-id gets from dev-name instead of address
      
       v2->v3:
       1. add Review-by: Andy Shevchenko
       2. fix the potential memory leak
      
       v1 -> v2:
       1. use acpi_dev_found() instead of acpi_match_device_ids() to check if
      it is a acpi node.
       2. use is_of_node() instead of IS_ENABLED() to check if it is a DT node.
       3. split the patch("add support of acpi for hns-mdio") into two patches:
          3.1 Move to use fwnode_handle
          3.2 Add ACPI
       4. add the patch which subject is dsaf misc operation method
       5. fix the comments by Andy Shevchenko
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b1c6a3a4
    • Kejian Yan's avatar
      net: hns: net: hns: enet adds support of acpi · 63434888
      Kejian Yan authored
      Enet needs to get configration parameter by acpi. This patch
      adds support of ACPI for enet. The configuration parameter will
      be configed in BIOS.
      Signed-off-by: default avatarKejian Yan <yankejian@huawei.com>
      Signed-off-by: default avatarYisen Zhuang <Yisen.Zhuang@huawei.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      63434888