linux-toradex.git/net/ipv4/inet_diag.c, branch v4.9.72

net: inet: diag: expose the socket mark to privileged processes.

2016-09-08T23:13:09+00:00

This adds the capability for a process that has CAP_NET_ADMIN on
a socket to see the socket mark in socket dumps.

Commit a52e95abf772 ("net: diag: allow socket bytecode filters to
match socket marks") recently gave privileged processes the
ability to filter socket dumps based on mark. This patch is
complementary: it ensures that the mark is also passed to
userspace in the socket's netlink attributes.  It is useful for
tools like ss which display information about sockets.

Tested: https://android-review.googlesource.com/270210
Signed-off-by: Lorenzo Colitti 
Signed-off-by: David S. Miller

net: diag: allow socket bytecode filters to match socket marks

2016-08-25T04:57:20+00:00

This allows a privileged process to filter by socket mark when
dumping sockets via INET_DIAG_BY_FAMILY. This is useful on
systems that use mark-based routing such as Android.

The ability to filter socket marks requires CAP_NET_ADMIN, which
is consistent with other privileged operations allowed by the
SOCK_DIAG interface such as the ability to destroy sockets and
the ability to inspect BPF filters attached to packet sockets.

Tested: https://android-review.googlesource.com/261350
Signed-off-by: Lorenzo Colitti 
Acked-by: David Ahern 
Signed-off-by: David S. Miller

net: diag: slightly refactor the inet_diag_bc_audit error checks.

2016-08-25T04:57:20+00:00

This simplifies the code a bit and also allows inet_diag_bc_audit
to send to userspace an error that isn't EINVAL.

Signed-off-by: Lorenzo Colitti 
Acked-by: David Ahern 
Signed-off-by: David S. Miller

net: diag: Add support to filter on device index

2016-06-28T09:25:04+00:00

Add support to inet_diag facility to filter sockets based on device
index. If an interface index is in the filter only sockets bound
to that index (sk_bound_dev_if) are returned.

Signed-off-by: David Ahern 
Signed-off-by: David S. Miller

sock_diag: align nlattr properly when needed

2016-04-26T16:00:48+00:00

I also fix the value of INET_DIAG_MAX. It's wrong since commit 8f840e47f190
which is only in net-next right now, thus I didn't make a separate patch.

Fixes: 8f840e47f190 ("sctp: add the sctp_diag.c file")
Signed-off-by: Nicolas Dichtel 
Signed-off-by: David S. Miller

net: use jiffies_to_msecs to replace EXPIRES_IN_MS in inet/sctp_diag

2016-04-21T17:55:33+00:00

EXPIRES_IN_MS macro comes from net/ipv4/inet_diag.c and dates
back to before jiffies_to_msecs() has been introduced.

Now we can remove it and use jiffies_to_msecs().

Suggested-by: Jakub Sitnicki 
Signed-off-by: Xin Long 
Acked-by: Jakub Sitnicki 
Acked-by: Marcelo Ricardo Leitner 
Acked-by: Eric Dumazet 
Signed-off-by: David S. Miller

sctp: export some functions for sctp_diag in inet_diag

2016-04-15T21:29:36+00:00

inet_diag_msg_common_fill is used to fill the diag msg common info,
we need to use it in sctp_diag as well, so export it.

inet_diag_msg_attrs_fill is used to fill some common attrs info between
sctp diag and tcp diag.

v2->v3:
- do not need to define and export inet_diag_get_handler any more.
  cause all the functions in it are in sctp_diag.ko, we just call
  them in sctp_diag.ko.

- add inet_diag_msg_attrs_fill to make codes clear.

Signed-off-by: Xin Long 
Signed-off-by: David S. Miller

tcp/dccp: do not touch listener sk_refcnt under synflood

2016-04-05T02:11:20+00:00

When a SYNFLOOD targets a non SO_REUSEPORT listener, multiple
cpus contend on sk->sk_refcnt and sk->sk_wmem_alloc changes.

By letting listeners use SOCK_RCU_FREE infrastructure,
we can relax TCP_LISTEN lookup rules and avoid touching sk_refcnt

Note that we still use SLAB_DESTROY_BY_RCU rules for other sockets,
only listeners are impacted by this change.

Peak performance under SYNFLOOD is increased by ~33% :

On my test machine, I could process 3.2 Mpps instead of 2.4 Mpps

Most consuming functions are now skb_set_owner_w() and sock_wfree()
contending on sk->sk_wmem_alloc when cooking SYNACK and freeing them.

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

tcp/dccp: use rcu locking in inet_diag_find_one_icsk()

2016-04-05T02:11:19+00:00

RX packet processing holds rcu_read_lock(), so we can remove
pairs of rcu_read_lock()/rcu_read_unlock() in lookup functions
if inet_diag also holds rcu before calling them.

This is needed anyway as __inet_lookup_listener() and
inet6_lookup_listener() will soon no longer increment
refcount on the found listener.

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

net: diag: add a scheduling point in inet_diag_dump_icsk()

2016-03-14T23:38:09+00:00

On loaded TCP servers, looking at millions of sockets can hold
cpu for many seconds, if the lookup condition is very narrow.

(eg : ss dst 1.2.3.4 )

Better add a cond_resched() to allow other processes to access
the cpu.

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller