Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
Daniel Borkmann b1dcdc68b1 net: tcp_probe: allow more advanced ingress filtering by mark ... Currently, the tcp_probe snooper can either filter packets by a given port (handed to the module via module parameter e.g. port=80) or lets all TCP traffic pass (port=0, default). When a port is specified, the port number is tested against the sk's source/destination port. Thus, if one of them matches, the information will be further processed for the log. As this is quite limited, allow for more advanced filtering possibilities which can facilitate debugging/analysis with the help of the tcp_probe snooper. Therefore, similarly as added to BPF machine in commit 7e75f93e ("pkt_sched: ingress socket filter by mark"), add the possibility to use skb->mark as a filter. If the mark is not being used otherwise, this allows ingress filtering by flow (e.g. in order to track updates from only a single flow, or a subset of all flows for a given port) and other things such as dynamic logging and reconfiguration without removing/re-inserting the tcp_probe module, etc. Simple example: insmod net/ipv4/tcp_probe.ko fwmark=8888 full=1 ... iptables -A INPUT -i eth4 -t mangle -p tcp --dport 22 \ --sport 60952 -j MARK --set-mark 8888 [... sampling interval ...] iptables -D INPUT -i eth4 -t mangle -p tcp --dport 22 \ --sport 60952 -j MARK --set-mark 8888 The current option to filter by a given port is still being preserved. A similar approach could be done for the sctp_probe module as a follow-up. Signed-off-by: Daniel Borkmann <dborkman@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2013-08-27 15:53:34 -04:00
..
netfilter	netfilter: nf_conntrack: don't send destroy events from iterator	2013-08-09 12:03:33 +02:00
af_inet.c	gro: remove a sparse error	2013-06-12 15:03:24 -07:00
ah4.c	ipv4: properly refresh rtable entries on pmtu/redirect events	2013-06-03 00:07:42 -07:00
arp.c	arp: flush arp cache on IFF_NOARP change	2013-05-28 13:11:02 -07:00
cipso_ipv4.c
datagram.c
devinet.c	net: igmp: Allow user-space configuration of igmp unsolicited report interval	2013-08-09 11:27:46 -07:00
esp4.c	net: esp{4,6}: fix potential MTU calculation overflows	2013-08-05 12:26:50 -07:00
fib_frontend.c	netlink: fix splat in skb_clone with large messages	2013-06-27 22:44:16 -07:00
fib_lookup.h
fib_rules.c	fib_rules: fix suppressor names and default values	2013-08-03 10:40:23 -07:00
fib_semantics.c	ipv4: use next hop exceptions also for input routes	2013-06-28 21:27:47 -07:00
fib_trie.c	fib_trie: remove potential out of bound access	2013-08-05 15:26:11 -07:00
gre_demux.c	net: gre: move GSO functions to gre_offload	2013-07-03 14:37:39 -07:00
gre_offload.c	gso: Update tunnel segmentation to support Tx checksum offload	2013-07-11 12:18:49 -07:00
icmp.c	icmp: avoid allocating large struct on stack	2013-06-03 00:28:44 -07:00
igmp.c	net: igmp: Allow user-space configuration of igmp unsolicited report interval	2013-08-09 11:27:46 -07:00
inet_connection_sock.c
inet_diag.c
inet_fragment.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2013-07-09 18:24:39 -07:00
inet_hashtables.c	inet: fix spacing in assignment	2013-07-11 12:02:39 -07:00
inet_lro.c
inet_timewait_sock.c
inetpeer.c
ip_forward.c
ip_fragment.c
ip_gre.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2013-08-16 15:37:26 -07:00
ip_input.c	net: add SNMP counters tracking incoming ECN bits	2013-08-08 22:24:59 -07:00
ip_options.c
ip_output.c	ipv4: ip_output: remove inline marking of EXPORT_SYMBOL functions	2013-05-11 16:12:44 -07:00
ip_sockglue.c
ip_tunnel.c	ipip: potential race in ip_tunnel_init_net()	2013-08-25 18:39:59 -04:00
ip_tunnel_core.c	ip_tunnel: Do not use inner ip-header-id for tunnel ip-header-id.	2013-08-13 16:52:50 -07:00
ip_vti.c	ipip: add x-netns support	2013-08-15 01:00:20 -07:00
ipcomp.c	ipv4: properly refresh rtable entries on pmtu/redirect events	2013-06-03 00:07:42 -07:00
ipconfig.c
ipip.c	ipip: add x-netns support	2013-08-15 01:00:20 -07:00
ipmr.c	ipmr: change the prototype of ip_mr_forward().	2013-07-23 17:01:05 -07:00
Kconfig	Kconfig: remove dangling references to the deleted file	2013-06-04 15:17:39 -07:00
Makefile	net: gre: move GSO functions to gre_offload	2013-07-03 14:37:39 -07:00
netfilter.c
ping.c	net: proc_fs: trivial: print UIDs as unsigned int	2013-08-15 14:37:46 -07:00
proc.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2013-08-16 15:37:26 -07:00
protocol.c
raw.c	net: proc_fs: trivial: print UIDs as unsigned int	2013-08-15 14:37:46 -07:00
route.c	ipv4: raise IP_MAX_MTU to theoretical limit	2013-08-20 15:05:04 -07:00
syncookies.c
sysctl_net_ipv4.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2013-08-03 21:36:46 -07:00
tcp.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2013-08-26 16:37:08 -04:00
tcp_bic.c
tcp_cong.c
tcp_cubic.c	tcp: cubic: fix bug in bictcp_acked()	2013-08-07 10:35:08 -07:00
tcp_diag.c
tcp_fastopen.c	tcp: add server ip to encrypt cookie in fast open	2013-08-10 00:35:33 -07:00
tcp_highspeed.c
tcp_htcp.c
tcp_hybla.c
tcp_illinois.c
tcp_input.c	tcp: increase throughput when reordering is high	2013-08-22 14:39:46 -07:00
tcp_ipv4.c	tcp: trivial: Remove nocache argument from tcp_v4_send_synack	2013-08-20 15:05:04 -07:00
tcp_lp.c
tcp_memcontrol.c
tcp_metrics.c	tcp: do not expire TCP fastopen cookies	2013-05-05 16:58:02 -04:00
tcp_minisocks.c	tcp: consolidate SYNACK RTT sampling	2013-07-22 17:53:42 -07:00
tcp_offload.c	net: tcp: move GRO/GSO functions to tcp_offload	2013-06-07 14:39:05 -07:00
tcp_output.c	tcp: TCP_NOTSENT_LOWAT socket option	2013-07-24 17:54:48 -07:00
tcp_probe.c	net: tcp_probe: allow more advanced ingress filtering by mark	2013-08-27 15:53:34 -04:00
tcp_scalable.c
tcp_timer.c
tcp_vegas.c
tcp_vegas.h
tcp_veno.c
tcp_westwood.c
tcp_yeah.c
tunnel4.c
udp.c	net: proc_fs: trivial: print UIDs as unsigned int	2013-08-15 14:37:46 -07:00
udp_diag.c
udp_impl.h
udp_offload.c	net: udp4: move GSO functions to udp_offload	2013-06-12 00:47:25 -07:00
udplite.c
xfrm4_input.c
xfrm4_mode_beet.c
xfrm4_mode_transport.c
xfrm4_mode_tunnel.c
xfrm4_output.c
xfrm4_policy.c
xfrm4_state.c
xfrm4_tunnel.c	sit: add IPv4 over IPv4 support	2013-05-31 17:19:05 -07:00