aboutsummaryrefslogtreecommitdiffstats
path: root/target/linux/generic/backport-4.14
Commit message (Collapse)AuthorAgeFilesLines
* generic: backport Wistron Neweb D19Q1 patchesPawel Dembicki2020-04-081-0/+54
| | | | | | | Backport patches which adds suport for the Wistron Neweb D19Q1 3G/4G modem, used in D-Link DWR-960. Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
* kernel: backport out-of-memory fix for non-Ethernet devicesRafał Miłecki2020-03-111-0/+71
| | | | | | | Doing up & down on non-Ethernet devices (e.g. monitor mode interface) was consuming memory. Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
* kernel: backport mtd partition address fix sent upstreamRafał Miłecki2020-03-091-0/+28
| | | | Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
* kernel: act_ctinfo: really fix backport this timeKevin Darbyshire-Bryant2020-01-241-1/+1
| | | | Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* kernel: act_ctinfo: fixup build error on 4.14Kevin Darbyshire-Bryant2020-01-241-2/+3
| | | | Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* kernel: bump 4.14 to 4.14.167Koen Vandeputte2020-01-241-1/+1
| | | | | | | | | Refreshed all patches. Compile-tested on: cns3xxx Runtime-tested on: cns3xxx Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* kernel: act_ctinfo: backport memory leak fixKevin Darbyshire-Bryant2020-01-241-4/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit 09d4f10a5e78d76a53e3e584f1e6a701b6d24108 ] Implement a cleanup method to properly free ci->params BUG: memory leak unreferenced object 0xffff88811746e2c0 (size 64): comm "syz-executor617", pid 7106, jiffies 4294943055 (age 14.250s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ c0 34 60 84 ff ff ff ff 00 00 00 00 00 00 00 00 .4`............. backtrace: [<0000000015aa236f>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline] [<0000000015aa236f>] slab_post_alloc_hook mm/slab.h:586 [inline] [<0000000015aa236f>] slab_alloc mm/slab.c:3320 [inline] [<0000000015aa236f>] kmem_cache_alloc_trace+0x145/0x2c0 mm/slab.c:3549 [<000000002c946bd1>] kmalloc include/linux/slab.h:556 [inline] [<000000002c946bd1>] kzalloc include/linux/slab.h:670 [inline] [<000000002c946bd1>] tcf_ctinfo_init+0x21a/0x530 net/sched/act_ctinfo.c:236 [<0000000086952cca>] tcf_action_init_1+0x400/0x5b0 net/sched/act_api.c:944 [<000000005ab29bf8>] tcf_action_init+0x135/0x1c0 net/sched/act_api.c:1000 [<00000000392f56f9>] tcf_action_add+0x9a/0x200 net/sched/act_api.c:1410 [<0000000088f3c5dd>] tc_ctl_action+0x14d/0x1bb net/sched/act_api.c:1465 [<000000006b39d986>] rtnetlink_rcv_msg+0x178/0x4b0 net/core/rtnetlink.c:5424 [<00000000fd6ecace>] netlink_rcv_skb+0x61/0x170 net/netlink/af_netlink.c:2477 [<0000000047493d02>] rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:5442 [<00000000bdcf8286>] netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline] [<00000000bdcf8286>] netlink_unicast+0x223/0x310 net/netlink/af_netlink.c:1328 [<00000000fc5b92d9>] netlink_sendmsg+0x2c0/0x570 net/netlink/af_netlink.c:1917 [<00000000da84d076>] sock_sendmsg_nosec net/socket.c:639 [inline] [<00000000da84d076>] sock_sendmsg+0x54/0x70 net/socket.c:659 [<0000000042fb2eee>] ____sys_sendmsg+0x2d0/0x300 net/socket.c:2330 [<000000008f23f67e>] ___sys_sendmsg+0x8a/0xd0 net/socket.c:2384 [<00000000d838e4f6>] __sys_sendmsg+0x80/0xf0 net/socket.c:2417 [<00000000289a9cb1>] __do_sys_sendmsg net/socket.c:2426 [inline] [<00000000289a9cb1>] __se_sys_sendmsg net/socket.c:2424 [inline] [<00000000289a9cb1>] __x64_sys_sendmsg+0x23/0x30 net/socket.c:2424 Fixes: 24ec483cec98 ("net: sched: Introduce act_ctinfo action") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Cc: Kevin 'ldir' Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk> Cc: Cong Wang <xiyou.wangcong@gmail.com> Cc: Toke Høiland-Jørgensen <toke@redhat.com> Acked-by: Kevin 'ldir' Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* kernel: bump 4.14 to 4.14.165Koen Vandeputte2020-01-201-1/+1
| | | | | | | | | Refreshed all patches. Compile-tested on: cns3xxx Runtime-tested on: cns3xxx Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* kernel: bump 4.14 to 4.14.164Koen Vandeputte2020-01-2017-91/+91
| | | | | | | | | Refreshed all patches. Compile-tested on: cns3xxx Runtime-tested on: cns3xxx Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* kernel: bump 4.14 to 4.14.162Hauke Mehrtens2020-01-051-1/+1
| | | | | | | | | Refreshed all patches. Compile-tested on: ramips Runtime-tested on: ramips Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* kernel: bump 4.14 to 4.14.160Hauke Mehrtens2019-12-242-3/+3
| | | | | | | | | Refreshed all patches. Compile-tested on: ipq40xx, apm821xx Runtime-tested on: ipq40xx Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* kernel: bump 4.14 to 4.14.158Koen Vandeputte2019-12-105-13/+13
| | | | | | | | | | | | Refreshed all patches. Altered patches: - 400-mtd-add-rootfs-split-support.patch Compile-tested on: cns3xxx Runtime-tested on: cns3xxx Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* kernel: act_ctinfo: fix updated backport on 4.14Kevin Darbyshire-Bryant2019-12-041-21/+8
| | | | | | | | It turns out my 4.14 testing had a rather large flaw in it and the 'extack' mechanism isn't quite ready. Remove the extack stuff from this backport. Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* kernel: act_ctinfo: update backportKevin Darbyshire-Bryant2019-12-031-33/+109
| | | | | | | | | | Since the original backports from kernel 5.3 a few things have been tweaked by kernel bumps & other upstream changes. Update the backport to reflect upstream as closely as possible and remove the bitrot. Functions remain the same, error reporting improved. Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* kernel: bump 4.14 to 4.14.156Koen Vandeputte2019-11-292-8/+8
| | | | | | | | | Refreshed all patches. Compile-tested on: cns3xxx Runtime-tested on: cns3xxx Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* kernel: nf_conntrack_rtcache: fix WARNING on rmmodYousong Zhou2019-11-231-3/+1
| | | | | | | Fixes b7c58a1ee ("kernel: nf_conntrack_rtcache: fix cleanup on netns delete and rmmod") Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* kernel: nf_conntrack_rtcache: fix WARNING on forward pathYousong Zhou2019-11-231-11/+1
| | | | | | | | | Fixes b7c58a1ee ("kernel: nf_conntrack_rtcache: fix cleanup on netns delete and rmmod") Resolves FS#2624 Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* kernel: nf_conntrack_rtcache: fix cleanup on netns delete and rmmodYousong Zhou2019-11-231-1/+13
| | | | | | | | Fixes FS#1472, FS#2353, FS#2426 Fixes: b3f95490 ("kernel: generic: Add kernel 4.14 support") Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com> Acked-by: Hauke Mehrtens <hauke@hauke-m.de>
* kernel: bump 4.14 to 4.14.154Koen Vandeputte2019-11-1911-36/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Refreshed all patches. Altered patches: - 902-debloat_proc.patch - 040-dmaengine-qcom-bam-Process-multiple-pending-descript.patch - 807-usb-support-layerscape.patch - 809-flexcan-support-layerscape.patch - 816-pcie-support-layerscape.patch Remove upstreamed: - 150-MIPS-bmips-mark-exception-vectors-as-char-arrays.patch - 303-spi-nor-enable-4B-opcodes-for-mx66l51235l.patch New symbols: X86_INTEL_MPX X86_INTEL_MEMORY_PROTECTION_KEYS X86_INTEL_TSX_MODE_OFF X86_INTEL_TSX_MODE_ON X86_INTEL_TSX_MODE_AUTO SGL_ALLOC Compile-tested on: cns3xxx, x86_64 Runtime-tested on: cns3xxx Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* kernel: fix LED netdev trigger on interface renameMartin Schiller2019-11-071-0/+54
| | | | | | | | | This fixes the netdev LED trigger for interfaces, which are renamed during initialization (e.g. ppp interfaces). Fixes: FS#2193 Fixes: FS#2239 Signed-off-by: Martin Schiller <ms@dev.tdt.de>
* kernel: bump 4.14 to 4.14.150Koen Vandeputte2019-10-301-1/+1
| | | | | | | | | Refreshed all patches. Compile-tested on: cns3xxx Runtime-tested on: cns3xxx Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* kernel: bump 4.14 to 4.14.149Koen Vandeputte2019-10-1516-102/+102
| | | | | | | | | | | | Refreshed all patches. Altered patches: - 820-sec-support-layerscape.patch Compile-tested on: cns3xxx, layerscape Runtime-tested on: cns3xxx Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* kernel: bump 4.14 to 4.14.148Koen Vandeputte2019-10-081-1/+1
| | | | | | | | | Refreshed all patches. Compile-tested on: cns3xxx Runtime-tested on: cns3xxx Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* kernel: fix issues with output routing in flow offloadFelix Fietkau2019-09-254-93/+43
| | | | | | | | Replace an old cleanup patch that never made it upstream with the proper upstream fix. This patch was incompatible with the recent changes that affected the way that the flow tuple dst entry was used. Signed-off-by: Felix Fietkau <nbd@nbd.name>
* kernel: port 4.19 xt_FLOWOFFLOAD changes to 4.14Felix Fietkau2019-09-251-0/+86
| | | | Signed-off-by: Felix Fietkau <nbd@nbd.name>
* kernel: bump 4.14 to 4.14.143Koen Vandeputte2019-09-132-291/+1
| | | | | | | | | | | | Refreshed all patches. Remove upstreamed: - 390-v5.3-net-sched-fix-action-ipt-crash.patch Compile-tested on: cns3xxx Runtime-tested on: cns3xxx Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* kernel: net_sched: fix a NULL pointer deref in ipt actionCong Wang2019-09-012-1/+291
| | | | | | | | | | | | | | | | | | | | The net pointer in struct xt_tgdtor_param is not explicitly initialized therefore is still NULL when dereferencing it. So we have to find a way to pass the correct net pointer to ipt_destroy_target(). The best way I find is just saving the net pointer inside the per netns struct tcf_idrinfo, which could make this patch smaller. Fixes: 0c66dc1ea3f0 ("netfilter: conntrack: register hooks in netns when needed by ruleset") Reported-and-tested-by: Tony Ambardar <itugrok@xxxxxxxxx> Cc: Jamal Hadi Salim <jhs@xxxxxxxxxxxx> Cc: Jiri Pirko <jiri@xxxxxxxxxxx> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> [Backport for kernel v4.19 and v4.14] [Bug Link: https://bugzilla.kernel.org/show_bug.cgi?id=204681] Signed-off-by: Tony Ambardar <itugrok@yahoo.com>
* kernel: bump 4.14 to 4.14.140Koen Vandeputte2019-08-281-1/+1
| | | | | | | | | Refreshed all patches. Compile-tested on: cns3xxx Runtime-tested on: cns3xxx Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* kernel: bump 4.14 to 4.14.138Koen Vandeputte2019-08-141-2/+2
| | | | | | | | | Refreshed all patches. Compile-tested on: cns3xxx Runtime-tested on: cns3xxx Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* kernel: bump 4.14 to 4.14.137Koen Vandeputte2019-08-091-2/+2
| | | | | | | | | Refreshed all patches. Compile-tested on: cns3xxx Runtime-tested on: cns3xxx Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* kernel: bump 4.14 to 4.14.136Koen Vandeputte2019-08-066-10/+10
| | | | | | | | | | | | | | | | | | | | | Refreshed all patches. Altered patches: - 306-v4.16-netfilter-remove-saveroute-indirection-in-struct-nf_.patch Remove upstreamed: - 100-powerpc-4xx-uic-clear-pending-interrupt-after-irq-ty.patch - 088-0002-i2c-qup-fixed-releasing-dma-without-flush-operation.patch - 500-arm64-dts-marvell-Fix-A37xx-UART0-register-size.patch Fixes: - CVE-2019-13648 - CVE-2019-10207 Compile-tested on: cns3xxx Runtime-tested on: cns3xxx Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* kernel: bump 4.14 to 4.14.134Koen Vandeputte2019-07-312-48/+1
| | | | | | | | | | | | | | | | | Refreshed all patches. Remove upstreamed: - 049-v4.20-mips-remove-superfluous-check-for-linux.patch - 303-MIPS-Fix-bounds-check-virt_addr_valid.patch Fixes: - CVE-2019-3846 - CVE-2019-3900 Compile-tested on: cns3xxx Runtime-tested on: cns3xxx Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* kernel: cherry pick patch removing __linux__ checkFredrik Olofsson2019-07-101-0/+47
| | | | | | | | | | This is already included in newer upstream. Needed to build BPF programs using the MIPS kernel include files. Without this patch, clang fails with "#error Use a Linux compiler or give up." in sgidefs.h when building BPF programs. Signed-off-by: Fredrik Olofsson <fredrik.olofsson@anyfinetworks.com>
* kernel: bump 4.14 to 4.14.132Koen Vandeputte2019-07-091-1/+1
| | | | | | | | | Refreshed all patches. Compile-tested on: cns3xxx Runtime-tested on: cns3xxx Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* kernel: bump 4.14 to 4.14.129Koen Vandeputte2019-06-244-23/+5
| | | | | | | | | Refreshed all patches. Compile-tested on: cns3xxx Runtime-tested on: cns3xxx Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* kernel: update act_ctinfoKevin Darbyshire-Bryant2019-06-201-10/+28
| | | | | | | Follow upstream changes - header file changes no executable difference at all Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* kernel: bump 4.14 to 4.14.128Koen Vandeputte2019-06-203-7/+7
| | | | | | | | | Refreshed all patches. Compile-tested on: cns3xxx Runtime-tested on: cns3xxx Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* kernel: bump 4.14 to 4.14.127Koen Vandeputte2019-06-181-2/+2
| | | | | | | | | | | | | | | Refreshed all patches. Fixes: - CVE-2019-11479 - CVE-2019-11478 - CVE-2019-11477 Compile-tested on: cns3xxx Runtime-tested on: cns3xxx Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* kernel: backport 4.18 patch adding DMI_PRODUCT_SKURafał Miłecki2019-06-171-0/+57
| | | | | | | | | It's needed for applying some hardware quirks. This fixes: drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c:60:20: error: 'DMI_PRODUCT_SKU' undeclared here (not in a function); did you mean 'DMI_PRODUCT_UUID'? DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "T8"), Fixes: 8888cb725d49 ("mac80211: brcm: backport remaining brcmfmac 5.2 patches") Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
* kernel: bump 4.14 to 4.14.125 (FS#2305 FS#2297)Koen Vandeputte2019-06-122-20/+2
| | | | | | | | | | | | | | | | Refreshed all patches. This bump contains upstream commits which seem to avoid (not properly fix) the errors as seen in FS#2305 and FS#2297 Altered patches: - 403-net-mvneta-convert-to-phylink.patch - 410-sfp-hack-allow-marvell-10G-phy-support-to-use-SFP.patch Compile-tested on: ar71xx, cns3xxx, imx6, mvebu, x86_64 Runtime-tested on: ar71xx, cns3xxx, imx6, x86_64 Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* kernel: backport act_ctinfoKevin Darbyshire-Bryant2019-06-061-0/+584
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ctinfo is a new tc filter action module. It is designed to restore information contained in firewall conntrack marks to other packet fields and is typically used on packet ingress paths. At present it has two independent sub-functions or operating modes, DSCP restoration mode & skb mark restoration mode. The DSCP restore mode: This mode copies DSCP values that have been placed in the firewall conntrack mark back into the IPv4/v6 diffserv fields of relevant packets. The DSCP restoration is intended for use and has been found useful for restoring ingress classifications based on egress classifications across links that bleach or otherwise change DSCP, typically home ISP Internet links. Restoring DSCP on ingress on the WAN link allows qdiscs such as but by no means limited to CAKE to shape inbound packets according to policies that are easier to set & mark on egress. Ingress classification is traditionally a challenging task since iptables rules haven't yet run and tc filter/eBPF programs are pre-NAT lookups, hence are unable to see internal IPv4 addresses as used on the typical home masquerading gateway. Thus marking the connection in some manner on egress for later restoration of classification on ingress is easier to implement. Parameters related to DSCP restore mode: dscpmask - a 32 bit mask of 6 contiguous bits and indicate bits of the conntrack mark field contain the DSCP value to be restored. statemask - a 32 bit mask of (usually) 1 bit length, outside the area specified by dscpmask. This represents a conditional operation flag whereby the DSCP is only restored if the flag is set. This is useful to implement a 'one shot' iptables based classification where the 'complicated' iptables rules are only run once to classify the connection on initial (egress) packet and subsequent packets are all marked/restored with the same DSCP. A mask of zero disables the conditional behaviour ie. the conntrack mark DSCP bits are always restored to the ip diffserv field (assuming the conntrack entry is found & the skb is an ipv4/ipv6 type) e.g. dscpmask 0xfc000000 statemask 0x01000000 |----0xFC----conntrack mark----000000---| | Bits 31-26 | bit 25 | bit24 |~~~ Bit 0| | DSCP | unused | flag |unused | |-----------------------0x01---000000---| | | | | ---| Conditional flag v only restore if set |-ip diffserv-| | 6 bits | |-------------| The skb mark restore mode (cpmark): This mode copies the firewall conntrack mark to the skb's mark field. It is completely the functional equivalent of the existing act_connmark action with the additional feature of being able to apply a mask to the restored value. Parameters related to skb mark restore mode: mask - a 32 bit mask applied to the firewall conntrack mark to mask out bits unwanted for restoration. This can be useful where the conntrack mark is being used for different purposes by different applications. If not specified and by default the whole mark field is copied (i.e. default mask of 0xffffffff) e.g. mask 0x00ffffff to mask out the top 8 bits being used by the aforementioned DSCP restore mode. |----0x00----conntrack mark----ffffff---| | Bits 31-24 | | | DSCP & flag| some value here | |---------------------------------------| | | v |------------skb mark-------------------| | | | | zeroed | | |---------------------------------------| Overall parameters: zone - conntrack zone control - action related control (reclassify | pipe | drop | continue | ok | goto chain <CHAIN_INDEX>) Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk> Reviewed-by: Toke Høiland-Jørgensen <toke@redhat.com> Acked-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Make suitable adjustments for backporting to 4.14 & 4.19 and add to SCHED_MODULES_FILTER Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* Revert "kernel: backport act_ctinfo"Kevin Darbyshire-Bryant2019-06-061-584/+0
| | | | | | | | | | This reverts commit 7c50182e0cdce0366715082872a2afbcf208bbf8. Produces build error: Package kmod-sched is missing dependencies for the following libraries: nf_conntrack.ko Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* kernel: backport act_ctinfoKevin Darbyshire-Bryant2019-06-061-0/+584
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ctinfo is a new tc filter action module. It is designed to restore information contained in firewall conntrack marks to other packet fields and is typically used on packet ingress paths. At present it has two independent sub-functions or operating modes, DSCP restoration mode & skb mark restoration mode. The DSCP restore mode: This mode copies DSCP values that have been placed in the firewall conntrack mark back into the IPv4/v6 diffserv fields of relevant packets. The DSCP restoration is intended for use and has been found useful for restoring ingress classifications based on egress classifications across links that bleach or otherwise change DSCP, typically home ISP Internet links. Restoring DSCP on ingress on the WAN link allows qdiscs such as but by no means limited to CAKE to shape inbound packets according to policies that are easier to set & mark on egress. Ingress classification is traditionally a challenging task since iptables rules haven't yet run and tc filter/eBPF programs are pre-NAT lookups, hence are unable to see internal IPv4 addresses as used on the typical home masquerading gateway. Thus marking the connection in some manner on egress for later restoration of classification on ingress is easier to implement. Parameters related to DSCP restore mode: dscpmask - a 32 bit mask of 6 contiguous bits and indicate bits of the conntrack mark field contain the DSCP value to be restored. statemask - a 32 bit mask of (usually) 1 bit length, outside the area specified by dscpmask. This represents a conditional operation flag whereby the DSCP is only restored if the flag is set. This is useful to implement a 'one shot' iptables based classification where the 'complicated' iptables rules are only run once to classify the connection on initial (egress) packet and subsequent packets are all marked/restored with the same DSCP. A mask of zero disables the conditional behaviour ie. the conntrack mark DSCP bits are always restored to the ip diffserv field (assuming the conntrack entry is found & the skb is an ipv4/ipv6 type) e.g. dscpmask 0xfc000000 statemask 0x01000000 |----0xFC----conntrack mark----000000---| | Bits 31-26 | bit 25 | bit24 |~~~ Bit 0| | DSCP | unused | flag |unused | |-----------------------0x01---000000---| | | | | ---| Conditional flag v only restore if set |-ip diffserv-| | 6 bits | |-------------| The skb mark restore mode (cpmark): This mode copies the firewall conntrack mark to the skb's mark field. It is completely the functional equivalent of the existing act_connmark action with the additional feature of being able to apply a mask to the restored value. Parameters related to skb mark restore mode: mask - a 32 bit mask applied to the firewall conntrack mark to mask out bits unwanted for restoration. This can be useful where the conntrack mark is being used for different purposes by different applications. If not specified and by default the whole mark field is copied (i.e. default mask of 0xffffffff) e.g. mask 0x00ffffff to mask out the top 8 bits being used by the aforementioned DSCP restore mode. |----0x00----conntrack mark----ffffff---| | Bits 31-24 | | | DSCP & flag| some value here | |---------------------------------------| | | v |------------skb mark-------------------| | | | | zeroed | | |---------------------------------------| Overall parameters: zone - conntrack zone control - action related control (reclassify | pipe | drop | continue | ok | goto chain <CHAIN_INDEX>) Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk> Reviewed-by: Toke Høiland-Jørgensen <toke@redhat.com> Acked-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Make suitable adjustments for backporting to 4.14 & 4.19 Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* kernel: bump 4.14 to 4.14.120Koen Vandeputte2019-05-2122-226/+226
| | | | | | | | | | | | | | | | | | Refreshed all patches. Remove upstreamed: - 103-MIPS-perf-ath79-Fix-perfcount-IRQ-assignment.patch - 060-fix-oxnas-rps-dt-match.patch Altered patches: - 0067-generic-Mangle-bootloader-s-kernel-arguments.patch - 006-mvebu-Mangle-bootloader-s-kernel-arguments.patch - 996-generic-Mangle-bootloader-s-kernel-arguments.patch Compile-tested on: ar71xx, cns3xxx, imx6, mvebu, x86_64 Runtime-tested on: ar71xx, cns3xxx, imx6, x86_64 Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* kernel: bump 4.14 to 4.14.118Koen Vandeputte2019-05-132-95/+1
| | | | | | | | | | | | | | | Refreshed all patches. Remove upstreamed: - 060-v5.1-serial-ar933x_uart-Fix-build-failure-with-disabled-c.patch Altered: - 143-gpio-fix-device-tree-gpio-hogs-on-dual-role-gpio-pin.patch Compile-tested on: ar71xx, cns3xxx, imx6, x86_64 Runtime-tested on: ar71xx, cns3xxx, imx6 Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* kernel: bump 4.14 to 4.14.114Koen Vandeputte2019-05-022-2/+2
| | | | | | | | | | | | | | | | Refreshed all patches. Altered patches: - 150-bridge_allow_receiption_on_disabled_port.patch - 201-extra_optimization.patch Remove upstreamed: - 022-0006-crypto-crypto4xx-properly-set-IV-after-de-and-encryp.patch Compile-tested on: ar71xx, cns3xxx, imx6, x86_64 Runtime-tested on: ar71xx, cns3xxx, imx6 Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* kernel: move and replace accepted patchDaniel Golle2019-04-111-0/+75
| | | | Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* kernel: bump 4.14 to 4.14.111Koen Vandeputte2019-04-083-6/+6
| | | | | | | | | Refreshed all patches. Compile-tested on: ar71xx, cns3xxx, imx6, x86_64 Runtime-tested on: ar71xx, cns3xxx, imx6 Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* kernel: bump 4.14 to 4.14.110Koen Vandeputte2019-04-081-1/+1
| | | | | | | | | Refreshed all patches. Compile-tested on: ar71xx, cns3xxx, imx6, x86_64 Runtime-tested on: ar71xx, cns3xxx, imx6 Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* kernel: backport upstream ubifs default compression selection fixRafał Miłecki2019-04-041-0/+37
| | | | Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-07 06:16:54 +0000