aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Merge "ss: remove wtf." am: 4bf8496 am: d9cdcb0 am: 1404f4ccm-14.0Josh Gao2016-05-121-1/+1
| | | | | | | | | | | am: 465a65c * commit '465a65c65df2b60a6010a56511378598917ce8b0': ss: remove wtf. Change-Id: Ib3ad0ca4e20765e5785850527adc4b702fcedaf4 (cherry picked from commit d60f0fa0525eb1b31605ef706585e850ae4c9f59) BUG: 28704419
* Merge "Fix GCC builds of \'ss\' by insisting on clang."Elliott Hughes2016-02-061-2/+2
|\ | | | | | | | | | | | | am: db60576af5 * commit 'db60576af5320d55ed48883440bbd2c844d95a5e': Fix GCC builds of 'ss' by insisting on clang.
| * Merge "Fix GCC builds of 'ss' by insisting on clang."Elliott Hughes2016-02-061-2/+2
| |\
| | * Fix GCC builds of 'ss' by insisting on clang.Elliott Hughes2016-02-051-2/+2
| |/ | | | | | | Change-Id: Ib63da11ccf4c18d4dda06a7fbcc3d594135e73d9
* | Merge "Add the ability to compile ss."Elliott Hughes2016-02-060-0/+0
|\| | | | | | | | | | | | | am: 9636248450 * commit '9636248450c1d82751e0337d4729e3c67b5c931c': Add the ability to compile ss.
| * Merge "Add the ability to compile ss."Elliott Hughes2016-02-062-1/+41
| |\
| | * Add the ability to compile ss.Lorenzo Colitti2016-02-052-1/+41
| |/ | | | | | | Change-Id: Ib52c1c1ad8a2cb5e633fd103b2b6354f5bc256b9
* | Merge "Merge remote-tracking branch \'aosp/upstream-master\' into mymerge"Elliott Hughes2016-02-06276-3066/+19895
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: 85dbc764c7 * commit '85dbc764c721a033af848596b1ca0fb25a5fcc9b': (361 commits) ss: support closing inet sockets via SOCK_DESTROY. libnetlink: don't print NETLINK_SOCK_DIAG errors in rtnl_talk ip-link: fix man page warnings vxlan: fix help and man text tc, bpf: more header checks on loading elf tc, bpf: check section names and type everywhere tc, clsact: add clsact frontend tc, ingress: clean up ingress handling a bit update headers (post 4.4 merge window) Revert "tc: fix compilation with old gcc (< 4.6)" tipc: add peer remove functionality v4.4.0 Revert "tipc: add peer remove functionality" tc: flower no need to specify the ethertype tc: fix compilation with old gcc (< 4.6) iplink: replace exit with return tc: m_connmark: Fix help text man: fix whatis for fq tipc: add peer remove functionality tipc: fix help text spelling error in node.c ...
| * Merge "Merge remote-tracking branch 'aosp/upstream-master' into mymerge"Elliott Hughes2016-02-06276-3066/+19895
| |\
| | * Merge remote-tracking branch 'aosp/upstream-master' into mymergeElliott Hughes2016-02-05276-3066/+19895
| |/| | | | | | | | | | Change-Id: Ibc952037986c546d20e75479fd2983d07111ff88
| | * ss: support closing inet sockets via SOCK_DESTROY.Lorenzo Colitti2016-01-182-2/+53
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds a -K / --kill option to ss that attempts to forcibly close matching sockets using SOCK_DESTROY. Because ss typically prints sockets instead of acting on them, and because the kernel only supports forcibly closing some types of sockets, the output of -K is as follows: - If closing the socket succeeds, the socket is printed. - If the kernel does not support forcibly closing this type of socket (e.g., if it's a UDP socket, or a TIME_WAIT socket), the socket is silently skipped. - If an error occurs (e.g., permission denied), the error is reported and ss exits. Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
| | * libnetlink: don't print NETLINK_SOCK_DIAG errors in rtnl_talkLorenzo Colitti2016-01-181-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | This change is a no-op, as currently no code uses rtnl_talk on NETLINK_SOCK_DIAG_BY_FAMILY sockets. It is needed to suppress spurious errors when using SOCK_DESTROY via rtnl_talk. Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
| | * ip-link: fix man page warningsThomas Faivre2016-01-181-51/+51
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | grff wrapper returns warnings when parsing the ip-link.8.in file. How to reproduce: $ man --warnings ip-link > /dev/null `R' is a string (producing the registered sign), not a macro. [...] Signed-off-by: Thomas Faivre <thomas.faivre@6wind.com> Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
| | * vxlan: fix help and man textThomas Faivre2016-01-182-2/+3
| | | | | | | | | | | | | | | | | | | | | Options 'group' and 'remote' cannot take 'any' as value but 'local' can. Signed-off-by: Thomas Faivre <thomas.faivre@6wind.com> Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
| | * tc, bpf: more header checks on loading elfDaniel Borkmann2016-01-181-0/+43
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | eBPF llvm backend can support different BPF formats, make sure the object we're trying to load matches with regards to endiannes and while at it, also check for other attributes related to BPF ELFs. # llc --version LLVM (http://llvm.org/): LLVM version 3.8.0svn Optimized build. Built Jan 9 2016 (02:08:10). Default target: x86_64-unknown-linux-gnu Host CPU: ivybridge Registered Targets: bpf - BPF (host endian) bpfeb - BPF (big endian) bpfel - BPF (little endian) [...] Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Alexei Starovoitov <ast@kernel.org>
| | * tc, bpf: check section names and type everywhereDaniel Borkmann2016-01-181-6/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When extracting sections, we better check for name and type. Noticed that some llvm versions emit .strtab and .shstrtab (e.g. saw it on pre 3.7), while more recent ones only seem to emit .strtab. Thus, make sure we get the right sections. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Alexei Starovoitov <ast@kernel.org>
| | * tc, clsact: add clsact frontendDaniel Borkmann2016-01-184-14/+88
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add the tc part for the kernel commit 1f211a1b929c ("net, sched: add clsact qdisc"). Quoting example usage from that commit description: Example, adding qdisc: # tc qdisc add dev foo clsact # tc qdisc show dev foo qdisc mq 0: root qdisc pfifo_fast 0: parent :1 bands 3 priomap 1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1 qdisc pfifo_fast 0: parent :2 bands 3 priomap 1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1 qdisc pfifo_fast 0: parent :3 bands 3 priomap 1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1 qdisc pfifo_fast 0: parent :4 bands 3 priomap 1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1 qdisc clsact ffff: parent ffff:fff1 Adding filters (deleting, etc works analogous by specifying ingress/egress): # tc filter add dev foo ingress bpf da obj bar.o sec ingress # tc filter add dev foo egress bpf da obj bar.o sec egress # tc filter show dev foo ingress filter protocol all pref 49152 bpf filter protocol all pref 49152 bpf handle 0x1 bar.o:[ingress] direct-action # tc filter show dev foo egress filter protocol all pref 49152 bpf filter protocol all pref 49152 bpf handle 0x1 bar.o:[egress] direct-action The ingress parent alias can also be used with ingress qdisc. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
| | * tc, ingress: clean up ingress handling a bitDaniel Borkmann2016-01-182-23/+8
| | | | | | | | | | | | | | | | | | | | | Clean it up a bit, we can also get rid of some ugly ifdefs as in our case TC_H_INGRESS is always defined. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
| | * update headers (post 4.4 merge window)Stephen Hemminger2016-01-182-1/+29
| | |
| | * Merge branch 'net-next'Stephen Hemminger2016-01-1856-1135/+3038
| | |\
| | | * tipc: add peer remove functionalityRichard Alpe2016-01-1112-1/+177
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This enables a user to remove an offline peer from the kernel data structures. This could for example be useful when deliberately scaling in peer nodes in a cloud environment. Signed-off-by: Richard Alpe <richard.alpe@ericsson.com> Reviewed-by: Jon Maloy <jon.maloy@ericsson.com> Reviewed-by: Ying Xue <ying.xue@windriver.com>
| | | * man: iplink: document new addrgenmodesBjørn Mork2016-01-061-3/+15
| | | | | | | | | | | | | | | | | | | | Cc: Hannes Frederic Sowa <hannes@stressinduktion.org> Signed-off-by: Bjørn Mork <bjorn@mork.no>
| | | * iplink: support show and set of "addrgenmode random"Bjørn Mork2016-01-062-1/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | "random" is a new IPv6 addrgenmode, enabling "stable_secret" type addresses with an auto-generated secret. $ ip link set eth0 addrgenmode random $ ip -d link show dev eth0 2: eth0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast state DOWN mode DEFAULT group default qlen 1000 link/ether 00:21:86:a3:25:7d brd ff:ff:ff:ff:ff:ff promiscuity 0 addrgenmode random Cc: Hannes Frederic Sowa <hannes@stressinduktion.org> Signed-off-by: Bjørn Mork <bjorn@mork.no>
| | | * iplink: support setting addrgenmode stable_secretBjørn Mork2016-01-061-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It is possible to switch to another addrgenmode after setting a valid secret. Allow switching back without reconfiguring the secret for completeness. Cc: Hannes Frederic Sowa <hannes@stressinduktion.org> Signed-off-by: Bjørn Mork <bjorn@mork.no>
| | | * update most kernel headersStephen Hemminger2016-01-063-0/+24
| | | | | | | | | | | | | | | | still have issues with xtables
| | | * Update to current iptables headersStephen Hemminger2016-01-039-434/+794
| | | | | | | | | | | | | | | | Keep in sync with current iptables upstream
| | | * add coverity model fileStephen Hemminger2015-12-301-0/+19
| | | | | | | | | | | | | | | | | | | | | | | | Track any coverity overrides for this project. Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
| | | * lnstat: fix error handlingStephen Hemminger2015-12-301-3/+10
| | | | | | | | | | | | | | | | | | | | | | | | Error handling was silent and had leaks. Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
| | | * monitor: fix file handle leakStephen Hemminger2015-12-303-5/+17
| | | | | | | | | | | | | | | | | | | | | | | | In some cases passing file to monitor left file open. Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
| | | * genl: make string constStephen Hemminger2015-12-301-1/+1
| | | | | | | | | | | | | | | | Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
| | | * iproute2: ip-route.8.in: Add expires option for ip routeHangbin Liu2015-12-301-1/+9
| | | | | | | | | | | | | | | | Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
| | | * iproute2: ip-route.8.in: Add missing '[' before 'pref'Hangbin Liu2015-12-301-1/+1
| | | | | | | | | | | | | | | | Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
| | | * route: allow routes to be configured with expire valuesHangbin Liu2015-12-211-1/+10
| | | | | | | | | | | | | | | | Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
| | | * Merge branch 'master' into net-nextStephen Hemminger2015-12-218-42/+160
| | | |\
| | | * | bpf: minor fix in api and bpf_dump_error() usageDaniel Borkmann2015-12-172-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix a whitespace in bpf_dump_error() usage, and also a missing closing bracket in ntohl() macro for eBPF programs. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
| | | * | include: update kernel headersStephen Hemminger2015-12-174-0/+6
| | | | | | | | | | | | | | | | | | | | Current headers for net-next
| | | * | Merge branch 'master' into net-nextStephen Hemminger2015-12-176-8/+139
| | | |\ \
| | | * | | examples, bpf: further improve examplesDaniel Borkmann2015-12-108-202/+327
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Improve example files further and add a more generic set of possible helpers for them that can be used. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Alexei Starovoitov <ast@kernel.org>
| | | * | | Merge branch 'master' into net-nextStephen Hemminger2015-12-107-42/+89
| | | |\ \ \
| | | * | | | {f,m}_bpf: add more example codeDaniel Borkmann2015-11-295-0/+241
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | I've added three examples to examples/bpf/ that demonstrate how one can implement eBPF tail calls in tc with f.e. multiple levels of nesting. That should act as a good starting point, but also as test cases for the ELF loader and kernel. A real test suite for {f,m,e}_bpf is still to be developed in future work. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Alexei Starovoitov <ast@kernel.org>
| | | * | | | {f,m}_bpf: allow updates on program arraysDaniel Borkmann2015-11-293-149/+306
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since we have all infrastructure in place now, allow atomic live updates on program arrays. This can be very useful e.g. in case programs that are being tail-called need to be replaced, f.e. when classifier functionality needs to be changed, new protocols added/removed during runtime, etc. Thus, provide a way for in-place code updates, minimal example: Given is an object file cls.o that contains the entry point in section 'classifier', has a globally pinned program array 'jmp' with 2 slots and id of 0, and two tail called programs under section '0/0' (prog array key 0) and '0/1' (prog array key 1), the section encoding for the loader is <id/key>. Adding the filter loads everything into cls_bpf: tc filter add dev foo parent ffff: bpf da obj cls.o Now, the program under section '0/1' needs to be replaced with an updated version that resides in the same section (also full path to tc's subfolder of the mount point can be passed, e.g. /sys/fs/bpf/tc/globals/jmp): tc exec bpf graft m:globals/jmp obj cls.o sec 0/1 In case the program resides under a different section 'foo', it can also be injected into the program array like: tc exec bpf graft m:globals/jmp key 1 obj cls.o sec foo If the new tail called classifier program is already available as a pinned object somewhere (here: /sys/fs/bpf/tc/progs/parser), it can be injected into the prog array like: tc exec bpf graft m:globals/jmp key 1 fd m:progs/parser In the kernel, the program on key 1 is being atomically replaced and the old one's refcount dropped. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Alexei Starovoitov <ast@kernel.org>
| | | * | | | {f, m}_bpf: allow for user-defined object pinningsDaniel Borkmann2015-11-295-25/+204
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The recently introduced object pinning can be further extended in order to allow sharing maps beyond tc namespace. F.e. maps that are being pinned from tracing side, can be accessed through this facility as well. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Alexei Starovoitov <ast@kernel.org>
| | | * | | | {f, m}_bpf: check map attributes when fetching as pinnedDaniel Borkmann2015-11-291-0/+53
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Make use of the new show_fdinfo() facility and verify that when a pinned map is being fetched that its basic attributes are the same as the map we declared from the ELF file. I.e. when placed into the globalns, collisions could occur. In such a case warn the user and bail out. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Alexei Starovoitov <ast@kernel.org>
| | | * | | | {f,m}_bpf: make tail calls workingDaniel Borkmann2015-11-291-8/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Now that we have the possibility of sharing maps, it's time we get the ELF loader fully working with regards to tail calls. Since program array maps are pinned, we can keep them finally alive. I've noticed two bugs that are being fixed in bpf_fill_prog_arrays() with this patch. Example code comes as follow-up. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Alexei Starovoitov <ast@kernel.org>
| | | * | | | Merge branch 'master' into net-nextStephen Hemminger2015-11-2914-196/+223
| | | |\ \ \ \
| | | * | | | | geneve: add support for IPv6 link partnersJohn W. Linville2015-11-231-7/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | | * | | | | {f,m}_bpf: allow for sharing mapsDaniel Borkmann2015-11-2310-608/+1105
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This larger work addresses one of the bigger remaining issues on tc's eBPF frontend, that is, to allow for persistent file descriptors. Whenever tc parses the ELF object, extracts and loads maps into the kernel, these file descriptors will be out of reach after the tc instance exits. Meaning, for simple (unnested) programs which contain one or multiple maps, the kernel holds a reference, and they will live on inside the kernel until the program holding them is unloaded, but they will be out of reach for user space, even worse with (also multiple nested) tail calls. For this issue, we introduced the concept of an agent that can receive the set of file descriptors from the tc instance creating them, in order to be able to further inspect/update map data for a specific use case. However, while that is more tied towards specific applications, it still doesn't easily allow for sharing maps accross multiple tc instances and would require a daemon to be running in the background. F.e. when a map should be shared by two eBPF programs, one attached to ingress, one to egress, this currently doesn't work with the tc frontend. This work solves exactly that, i.e. if requested, maps can now be _arbitrarily_ shared between object files (PIN_GLOBAL_NS) or within a single object (but various program sections, PIN_OBJECT_NS) without "loosing" the file descriptor set. To make that happen, we use eBPF object pinning introduced in kernel commit b2197755b263 ("bpf: add support for persistent maps/progs") for exactly this purpose. The shipped examples/bpf/bpf_shared.c code from this patch can be easily applied, for instance, as: - classifier-classifier shared: tc filter add dev foo parent 1: bpf obj shared.o sec egress tc filter add dev foo parent ffff: bpf obj shared.o sec ingress - classifier-action shared (here: late binding to a dummy classifier): tc actions add action bpf obj shared.o sec egress pass index 42 tc filter add dev foo parent ffff: bpf obj shared.o sec ingress tc filter add dev foo parent 1: bpf bytecode '1,6 0 0 4294967295,' \ action bpf index 42 The toy example increments a shared counter on egress and dumps its value on ingress (if no sharing (PIN_NONE) would have been chosen, map value is 0, of course, due to the two map instances being created): [...] <idle>-0 [002] ..s. 38264.788234: : map val: 4 <idle>-0 [002] ..s. 38264.788919: : map val: 4 <idle>-0 [002] ..s. 38264.789599: : map val: 5 [...] ... thus if both sections reference the pinned map(s) in question, tc will take care of fetching the appropriate file descriptor. The patch has been tested extensively on both, classifier and action sides. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
| | * | | | | | Revert "tc: fix compilation with old gcc (< 4.6)"Stephen Hemminger2016-01-181-27/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit 8f80d450c3cb0996d839996807b77ca28bd4da09.
| | * | | | | | v4.4.0Stephen Hemminger2016-01-111-1/+1
| | | | | | | |
| | * | | | | | Revert "tipc: add peer remove functionality"Stephen Hemminger2016-01-1112-177/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit d4585a4bb120e2f60b088a7e934bf2ae4e6b5b68. This commit is meant for later kernel.
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-18 09:39:03 +0000