linux-toradex.git/net/sched/act_api.c, branch v3.16.2

net: Use netlink_ns_capable to verify the permisions of netlink messages

2014-04-24T17:44:54+00:00

It is possible by passing a netlink socket to a more privileged
executable and then to fool that executable into writing to the socket
data that happens to be valid netlink message to do something that
privileged executable did not intend to do.

To keep this from happening replace bare capable and ns_capable calls
with netlink_capable, netlink_net_calls and netlink_ns_capable calls.
Which act the same as the previous calls except they verify that the
opener of the socket had the desired permissions as well.

Reported-by: Andy Lutomirski 
Signed-off-by: "Eric W. Biederman" 
Signed-off-by: David S. Miller

net_sched: act: clean up tca_action_flush()

2014-02-13T00:23:32+00:00

We could allocate tc_action on stack in tca_action_flush(),
since it is not large.

Also, we could use create_a() in tcf_action_get_1().

Cc: Jamal Hadi Salim 
Cc: David S. Miller 
Signed-off-by: Cong Wang 
Signed-off-by: Jamal Hadi Salim 
Signed-off-by: David S. Miller

net_sched: act: refuse to remove bound action outside

2014-02-13T00:23:32+00:00

When an action is bonnd to a filter, there is no point to
remove it outside. Currently we just silently decrease the refcnt,
we should reject this explicitly with EPERM.

Cc: Jamal Hadi Salim 
Cc: David S. Miller 
Signed-off-by: Cong Wang 
Signed-off-by: Jamal Hadi Salim 
Signed-off-by: David S. Miller

net_sched: act: move tcf_hashinfo_init() into tcf_register_action()

2014-02-13T00:23:32+00:00

Cc: Jamal Hadi Salim 
Cc: David S. Miller 
Signed-off-by: Cong Wang 
Signed-off-by: Jamal Hadi Salim 
Signed-off-by: David S. Miller

net_sched: act: refactor cleanup ops

2014-02-13T00:23:32+00:00

For bindcnt and refcnt etc., they are common for all actions,
not need to repeat such operations for their own, they can be unified
now. Actions just need to do its specific cleanup if needed.

Cc: Jamal Hadi Salim 
Cc: David S. Miller 
Signed-off-by: Cong Wang 
Signed-off-by: Jamal Hadi Salim 
Signed-off-by: David S. Miller

net_sched: act: hide struct tcf_common from API

2014-02-13T00:23:32+00:00

Now we can totally hide it from modules. tcf_hash_*() API's
will operate on struct tc_action, modules don't need to care about
the details.

Cc: Jamal Hadi Salim 
Cc: David S. Miller 
Signed-off-by: Cong Wang 
Signed-off-by: Jamal Hadi Salim 
Signed-off-by: David S. Miller

net_sched: act: export tcf_hash_search() instead of tcf_hash_lookup()

2014-01-21T22:43:16+00:00

So that we will not expose struct tcf_common to modules.

Cc: Jamal Hadi Salim 
Cc: David S. Miller 
Signed-off-by: Cong Wang 
Signed-off-by: Jamal Hadi Salim 
Signed-off-by: David S. Miller

net_sched: act: fetch hinfo from a->ops->hinfo

2014-01-21T22:43:16+00:00

Every action ops has a pointer to hash info, so we don't need to
hard-code it in each module.

Cc: Jamal Hadi Salim 
Cc: David S. Miller 
Signed-off-by: Cong Wang 
Signed-off-by: Jamal Hadi Salim 
Signed-off-by: David S. Miller

net_sched: act: remove struct tcf_act_hdr

2014-01-13T19:50:15+00:00

It is not necessary at all.

Cc: Jamal Hadi Salim 
Cc: David S. Miller 
Signed-off-by: Cong Wang 
Signed-off-by: Jamal Hadi Salim 
Signed-off-by: David S. Miller

net_sched: act: clean up notification functions

2014-01-13T19:50:14+00:00

Refactor tcf_add_notify() and factor out tcf_del_notify().

Cc: Jamal Hadi Salim 
Cc: David S. Miller 
Signed-off-by: Cong Wang 
Signed-off-by: Jamal Hadi Salim 
Signed-off-by: David S. Miller