Re: [PATCH PATCH net-next 15/18] sunrpc: whitespace fixes

2018-07-27 Thread Anna Schumaker
On 07/24/2018 03:29 PM, Stephen Hemminger wrote: > Remove trailing whitespace and blank line at EOF Looks good to me, I've applied it to my tree. Thanks! Anna > > Signed-off-by: Stephen Hemminger > --- > net/sunrpc/auth_gss/auth_gss.c | 2 +- > net/sunrpc/auth_gss/gss_generic_token.c

Re: [PATCH 00/18] xfrm: Add compat layer

2018-07-27 Thread Andy Lutomirski
> On Jul 27, 2018, at 9:48 AM, Nathan Harold wrote: > > We (Android) are very interested in removing the restriction for 32-bit > userspace processes accessing xfrm netlink on 64-bit kernels. IPsec support > is required to pass Android conformance tests, and any manufacturer wishing > to shi

Re: [PATCH 00/18] xfrm: Add compat layer

2018-07-27 Thread Nathan Harold
*We (Android) are very interested in removing the restriction for 32-bit userspace processes accessing xfrm netlink on 64-bit kernels. IPsec support is required to pass Android conformance tests, and any manufacturer wishing to ship 32-bit userspace with a recent kernel needs out-of-tree changes (r

Re: [PATCH RFC/RFT net-next 00/17] net: Convert neighbor tables to per-namespace

2018-07-27 Thread Eric W. Biederman
David Laight writes: > From: Eric W. Biederman >> Sent: 25 July 2018 18:38 > ... >> >> Further unless I misread something you are increasing the number of >> >> timers to 3 per namespace. If I create create a thousand network >> >> namespaces that feels like it will hurt system performance overa

Re: [iptables PATCH 00/23] Fixes and tests for {eb,arp}tables-{save,restore}

2018-07-27 Thread Phil Sutter
Hi, On Fri, Jul 27, 2018 at 12:22:19AM +0200, Phil Sutter wrote: > As (probably) expected, this series not only contains the requested > testcases, but also a huge pile of fixes. Some of them fix memleaks > identified using valgrind. Please don't apply this series (yet) - on top of the other issu

Re: [PATCH] netfilter: ipset: export indexes via netlink

2018-07-27 Thread Florent Fourcot
Hi Jozsef, On pyroute2 library, a method can build a python object based on netlink messages: https://github.com/svinota/pyroute2/blob/master/pyroute2/wiset.py#L174 We could of course fill index attribute with your new command, but that could be nice as well to read it in the same way (list)

Re: [PATCH 00/18] xfrm: Add compat layer

2018-07-27 Thread Dmitry Safonov
On Fri, 2018-07-27 at 16:19 +0200, Florian Westphal wrote: > Dmitry Safonov wrote: > > 1. It will double copy netlink messages, making it O(n) instead of > > O(1), where n - is number of bind()s.. Probably we don't care much. > > About those bind() patches, I don't understand why they are needed.

Re: [PATCH v4 nft] Set/print standard chain prios with textual names

2018-07-27 Thread Máté Eckl
On Fri, Jul 13, 2018 at 02:43:46PM +0200, Máté Eckl wrote: > On Fri, Jul 13, 2018 at 02:38:19PM +0200, Florian Westphal wrote: > > Máté Eckl wrote: > > > But that means that this solution cannot support bridge family at all. Or > > > BRNF > > > stands for something that can be interpreted as filt

Re: [PATCH v4 nft] Set/print standard chain prios with textual names

2018-07-27 Thread Máté Eckl
On Mon, Jul 16, 2018 at 09:58:44AM +0200, Máté Eckl wrote: > On Tue, Jul 10, 2018 at 12:10:22PM +0200, Pablo Neira Ayuso wrote: > > > diff --git a/src/parser_bison.y b/src/parser_bison.y > > > index 98bfeba..2b7d7cc 100644 > > > --- a/src/parser_bison.y > > > +++ b/src/parser_bison.y > > > @@ -182,

Re: [PATCH 00/18] xfrm: Add compat layer

2018-07-27 Thread Florian Westphal
Dmitry Safonov wrote: > 1. It will double copy netlink messages, making it O(n) instead of > O(1), where n - is number of bind()s.. Probably we don't care much. About those bind() patches, I don't understand why they are needed. Why can't you just add the compat skb to the native skb when doing

Re: [PATCH v4 nf-next] netfilter: Add native tproxy support for nf_tables

2018-07-27 Thread Máté Eckl
On Mon, Jul 23, 2018 at 09:28:27AM +0200, Máté Eckl wrote: > On Fri, Jul 20, 2018 at 03:28:31PM +0200, Pablo Neira Ayuso wrote: > > Hi Mate, > > > > A few comestic on the _init path, and one concern of probably missing > > sanity check, also from the _init path see below. > > > > On Fri, Jul 20,

Re: [PATCH 00/18] xfrm: Add compat layer

2018-07-27 Thread Dmitry Safonov
On Fri, 2018-07-27 at 09:37 +0200, Steffen Klassert wrote: > On Thu, Jul 26, 2018 at 10:49:59AM +0200, Florian Westphal wrote: > > Dmitry Safonov wrote: > > > So, here I add a compatible layer to xfrm. > > > As xfrm uses netlink notifications, kernel should send them in > > > ABI > > > format that

KMSAN: uninit-value in iptable_mangle_hook (3)

2018-07-27 Thread syzbot
Hello, syzbot found the following crash on: HEAD commit:d1c2a46a46f6 kmsan: update LLVM/Clang patches to r337583. git tree: https://github.com/google/kmsan.git/master console output: https://syzkaller.appspot.com/x/log.txt?x=16a2732c40 kernel config: https://syzkaller.appspot.com/

Re: [iptables PATCH 14/23] ebtables: Fix segfault when parsing a rule

2018-07-27 Thread Florian Westphal
Pablo Neira Ayuso wrote: > On Fri, Jul 27, 2018 at 12:53:22PM +0200, Phil Sutter wrote: > > Hi, > > > > On Fri, Jul 27, 2018 at 11:45:16AM +0200, Pablo Neira Ayuso wrote: > > > On Fri, Jul 27, 2018 at 12:22:33AM +0200, Phil Sutter wrote: > > > > This should happen in ebtables-restore only: If a p

Re: [iptables PATCH 21/23] xtables: Always set FMT_NUMERIC when saving rules

2018-07-27 Thread Pablo Neira Ayuso
On Fri, Jul 27, 2018 at 01:28:21PM +0200, Phil Sutter wrote: > Hi, > > On Fri, Jul 27, 2018 at 11:48:18AM +0200, Pablo Neira Ayuso wrote: > > On Fri, Jul 27, 2018 at 12:22:40AM +0200, Phil Sutter wrote: > > > Reverse IP address lookups may take a long time, something that's not > > > expected from

Re: [iptables PATCH 13/23] ebtables: Fix loading of non-standard targets

2018-07-27 Thread Pablo Neira Ayuso
On Fri, Jul 27, 2018 at 12:22:32AM +0200, Phil Sutter wrote: > Another fix for ebtables-restore: When encountering a non-standard > target, command_jump() tries to load it and may retrieve an already > loaded one taken from xtables_targets. Detect this by checking whether > option_offset field is n

Re: [iptables PATCH 14/23] ebtables: Fix segfault when parsing a rule

2018-07-27 Thread Pablo Neira Ayuso
On Fri, Jul 27, 2018 at 12:53:22PM +0200, Phil Sutter wrote: > Hi, > > On Fri, Jul 27, 2018 at 11:45:16AM +0200, Pablo Neira Ayuso wrote: > > On Fri, Jul 27, 2018 at 12:22:33AM +0200, Phil Sutter wrote: > > > This should happen in ebtables-restore only: If a previous rule > > > contained a standar

Re: [iptables PATCH 21/23] xtables: Always set FMT_NUMERIC when saving rules

2018-07-27 Thread Phil Sutter
Hi, On Fri, Jul 27, 2018 at 11:48:18AM +0200, Pablo Neira Ayuso wrote: > On Fri, Jul 27, 2018 at 12:22:40AM +0200, Phil Sutter wrote: > > Reverse IP address lookups may take a long time, something that's not > > expected from {ip,ip6,eb,arp}tables-save. Moreover, due to lack of an > > appropriate

Re: [iptables PATCH 11/23] xtables: Fix for empty quotes in add_params_to_argv()

2018-07-27 Thread Pablo Neira Ayuso
On Fri, Jul 27, 2018 at 12:45:13PM +0200, Phil Sutter wrote: > Hi, > > On Fri, Jul 27, 2018 at 11:43:20AM +0200, Pablo Neira Ayuso wrote: > > On Fri, Jul 27, 2018 at 12:22:30AM +0200, Phil Sutter wrote: > > > It is perfectly legal to specify an empty argument using two double > > > quotes, e.g. '-

Re: [iptables PATCH 14/23] ebtables: Fix segfault when parsing a rule

2018-07-27 Thread Phil Sutter
Hi, On Fri, Jul 27, 2018 at 11:45:16AM +0200, Pablo Neira Ayuso wrote: > On Fri, Jul 27, 2018 at 12:22:33AM +0200, Phil Sutter wrote: > > This should happen in ebtables-restore only: If a previous rule > > contained a standard target, the standard target object is inserted into > > xtables_targets

Re: [iptables PATCH 11/23] xtables: Fix for empty quotes in add_params_to_argv()

2018-07-27 Thread Phil Sutter
Hi, On Fri, Jul 27, 2018 at 11:43:20AM +0200, Pablo Neira Ayuso wrote: > On Fri, Jul 27, 2018 at 12:22:30AM +0200, Phil Sutter wrote: > > It is perfectly legal to specify an empty argument using two double > > quotes, e.g. '--log-prefix ""'. Fix the parser in add_param_to_argv() to > > detect this

Re: [iptables PATCH 21/23] xtables: Always set FMT_NUMERIC when saving rules

2018-07-27 Thread Pablo Neira Ayuso
On Fri, Jul 27, 2018 at 12:22:40AM +0200, Phil Sutter wrote: > Reverse IP address lookups may take a long time, something that's not > expected from {ip,ip6,eb,arp}tables-save. Moreover, due to lack of an > appropriate commandline option, it is not even avoidable for users. > > Setting FMT_NUMERIC

Re: [iptables PATCH 14/23] ebtables: Fix segfault when parsing a rule

2018-07-27 Thread Pablo Neira Ayuso
On Fri, Jul 27, 2018 at 12:22:33AM +0200, Phil Sutter wrote: > This should happen in ebtables-restore only: If a previous rule > contained a standard target, the standard target object is inserted into > xtables_targets. Though since that doesn't have a 'parse' callback, the > code segfaults. There

Re: [iptables PATCH 11/23] xtables: Fix for empty quotes in add_params_to_argv()

2018-07-27 Thread Pablo Neira Ayuso
On Fri, Jul 27, 2018 at 12:22:30AM +0200, Phil Sutter wrote: > It is perfectly legal to specify an empty argument using two double > quotes, e.g. '--log-prefix ""'. Fix the parser in add_param_to_argv() to > detect this situation and not treat it like double spaces. Not sure about this one, becaus

Re: [iptables PATCH 06/23] xtables: Fix ebtables-restore

2018-07-27 Thread Pablo Neira Ayuso
On Fri, Jul 27, 2018 at 12:22:25AM +0200, Phil Sutter wrote: > @@ -685,13 +693,20 @@ int xtables_eb_restore_main(int argc, char *argv[]) Side note: Is there any chance we can use xtables_restore_parse() in the midrun? Thanks. -- To unsubscribe from this list: send the line "unsubscribe netfilter-

Re: [PATCH 00/18] xfrm: Add compat layer

2018-07-27 Thread Steffen Klassert
On Thu, Jul 26, 2018 at 10:49:59AM +0200, Florian Westphal wrote: > Dmitry Safonov wrote: > > So, here I add a compatible layer to xfrm. > > As xfrm uses netlink notifications, kernel should send them in ABI > > format that an application will parse. The proposed solution is > > to save the ABI of