kernel.git/net/ipv6/sit.c, branch linux-3.11.y

sit: amend "allow to use rtnl ops on fb tunnel"

2013-11-04T12:35:13Z

Amend backport to 3.11.y of [ Upstream commit 205983c43700ac3a81e7625273a3fa83cd2759b5 ] The discussion thread in the upstream commit mentions that in backports to stable-* branches, the line - unregister_netdevice_queue(sitn->fb_tunnel_dev, &list); must be omitted if that branch does not have commit 5e6700b3bf98 ("sit: add support of x-netns"). This line has correctly been omitted in the backport to 3.10, which indeed does not have that commit. It was also removed in the backport to 3.11.y, which does have that commit. This causes the following steps to hit a BUG at net/core/dev.c:5039: `modprobe sit; rmmod sit` The bug demonstrates that it causes a device to be unregistered twice. The simple fix is to apply the one line in the upstream commit that was dropped in the backport to 3.11 (3783100374653e2e7fbdf68c710f5). This brings the logic in line with upstream linux, net and net-next branches. Signed-off-by: Willem de Bruijn Acked-by: Nicolas Dichtel Reviewed-by: Veaceslav Falico Signed-off-by: Greg Kroah-Hartman

sit: allow to use rtnl ops on fb tunnel

2013-10-14T01:14:27Z

[ Upstream commit 205983c43700ac3a81e7625273a3fa83cd2759b5 ] rtnl ops where introduced by ba3e3f50a0e5 ("sit: advertise tunnel param via rtnl"), but I forget to assign rtnl ops to fb tunnels. Now that it is done, we must remove the explicit call to unregister_netdevice_queue(), because the fallback tunnel is added to the queue in sit_destroy_tunnels() when checking rtnl_link_ops of all netdevices (this is valid since commit 5e6700b3bf98 ("sit: add support of x-netns")). Signed-off-by: Nicolas Dichtel Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman

IPv6 NAT: Do not drop DNATed 6to4/6rd packets

2013-10-14T01:14:26Z

[ Upstream commit 7df37ff33dc122f7bd0614d707939fe84322d264 ] When a router is doing DNAT for 6to4/6rd packets the latest anti-spoofing commit 218774dc ("ipv6: add anti-spoofing checks for 6to4 and 6rd") will drop them because the IPv6 address embedded does not match the IPv4 destination. This patch will allow them to pass by testing if we have an address that matches on 6to4/6rd interface. I have been hit by this problem using Fedora and IPV6TO4_IPV4ADDR. Also, log the dropped packets (with rate limit). Signed-off-by: Catalin(ux) M. BOIE Acked-by: Hannes Frederic Sowa Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman

ipv4 tunnels: fix an oops when using ipip/sit with IPsec

2013-08-30T21:13:28Z

Since commit 3d7b46cd20e3 (ip_tunnel: push generic protocol handling to ip_tunnel module.), an Oops is triggered when an xfrm policy is configured on an IPv4 over IPv4 tunnel. xfrm4_policy_check() calls __xfrm_policy_check2(), which uses skb_dst(skb). But this field is NULL because iptunnel_pull_header() calls skb_dst_drop(skb). Signed-off-by: Li Hongjun Signed-off-by: Nicolas Dichtel Signed-off-by: David S. Miller

ipv6: wire up skb->encapsulation

2013-08-19T07:37:46Z

When pushing a new header before current one call skb_reset_inner_headers to record the position of the inner headers in the various ipv6 tunnel protocols. We later need this to correctly identify the addresses needed to send back an error in the xfrm layer. This change is safe, because skb->protocol is always checked before dereferencing data from the inner protocol. Cc: Steffen Klassert Cc: YOSHIFUJI Hideaki Cc: Nicolas Dichtel Acked-by: Eric Dumazet Signed-off-by: Hannes Frederic Sowa Signed-off-by: Steffen Klassert

sit: fix tunnel update via netlink

2013-07-04T21:55:47Z

The device can stand in another netns, hence we need to do the lookup in netns tunnel->net. Signed-off-by: Nicolas Dichtel Signed-off-by: David S. Miller

ipv6: only apply anti-spoofing checks to not-pointopoint tunnels

2013-07-01T20:26:18Z

Because of commit 218774dc341f219bfcf940304a081b121a0e8099 ("ipv6: add anti-spoofing checks for 6to4 and 6rd") the sit driver dropped packets for 2002::/16 destinations and sources even when configured to work as a tunnel with fixed endpoint. We may only apply the 6rd/6to4 anti-spoofing checks if the device is not in pointopoint mode. This was an oversight from me in the above commit, sorry. Thanks to Roman Mamedov for reporting this! Reported-by: Roman Mamedov Cc: David Miller Cc: YOSHIFUJI Hideaki Signed-off-by: Hannes Frederic Sowa Signed-off-by: David S. Miller

sit: add support of x-netns

2013-06-28T05:30:47Z

This patch allows to switch the netns when packet is encapsulated or decapsulated. In other word, the encapsulated packet is received in a netns, where the lookup is done to find the tunnel. Once the tunnel is found, the packet is decapsulated and injecting into the corresponding interface which stands to another netns. When one of the two netns is removed, the tunnel is destroyed. Signed-off-by: Nicolas Dichtel Signed-off-by: David S. Miller

sit: fix an oops when IFLA_IPTUN_PROTO is not set

2013-06-20T04:18:17Z

The use of this attribute has been added in 32b8a8e59c9c (sit: add IPv4 over IPv4 support). It is optional, by default proto is IPPROTO_IPV6. Signed-off-by: Nicolas Dichtel Signed-off-by: David S. Miller

ip_tunnel: push generic protocol handling to ip_tunnel module.

2013-06-20T01:07:41Z

Process skb tunnel header before sending packet to protocol handler. this allows code sharing between gre and ovs gre modules. Signed-off-by: Pravin B Shelar Signed-off-by: David S. Miller