2005-04-17 00:20:36 +02:00
|
|
|
#
|
|
|
|
|
# Makefile for the Linux TCP/IP (INET) layer.
|
|
|
|
|
#
|
|
|
|
|
|
2005-07-28 00:24:42 +02:00
|
|
|
obj-y := route.o inetpeer.o protocol.o \
|
2005-04-17 00:20:36 +02:00
|
|
|
ip_input.o ip_fragment.o ip_forward.o ip_options.o \
|
2005-08-10 05:00:51 +02:00
|
|
|
ip_output.o ip_sockglue.o inet_hashtables.o \
|
2005-08-10 05:11:08 +02:00
|
|
|
inet_timewait_sock.o inet_connection_sock.o \
|
2005-06-23 21:19:55 +02:00
|
|
|
tcp.o tcp_input.o tcp_output.o tcp_timer.o tcp_ipv4.o \
|
|
|
|
|
tcp_minisocks.o tcp_cong.o \
|
2006-11-27 20:10:57 +01:00
|
|
|
datagram.o raw.o udp.o udplite.o \
|
|
|
|
|
arp.o icmp.o devinet.o af_inet.o igmp.o \
|
2011-02-02 00:15:39 +01:00
|
|
|
fib_frontend.o fib_semantics.o fib_trie.o \
|
net: ipv4: add IPPROTO_ICMP socket kind
This patch adds IPPROTO_ICMP socket kind. It makes it possible to send
ICMP_ECHO messages and receive the corresponding ICMP_ECHOREPLY messages
without any special privileges. In other words, the patch makes it
possible to implement setuid-less and CAP_NET_RAW-less /bin/ping. In
order not to increase the kernel's attack surface, the new functionality
is disabled by default, but is enabled at bootup by supporting Linux
distributions, optionally with restriction to a group or a group range
(see below).
Similar functionality is implemented in Mac OS X:
http://www.manpagez.com/man/4/icmp/
A new ping socket is created with
socket(PF_INET, SOCK_DGRAM, PROT_ICMP)
Message identifiers (octets 4-5 of ICMP header) are interpreted as local
ports. Addresses are stored in struct sockaddr_in. No port numbers are
reserved for privileged processes, port 0 is reserved for API ("let the
kernel pick a free number"). There is no notion of remote ports, remote
port numbers provided by the user (e.g. in connect()) are ignored.
Data sent and received include ICMP headers. This is deliberate to:
1) Avoid the need to transport headers values like sequence numbers by
other means.
2) Make it easier to port existing programs using raw sockets.
ICMP headers given to send() are checked and sanitized. The type must be
ICMP_ECHO and the code must be zero (future extensions might relax this,
see below). The id is set to the number (local port) of the socket, the
checksum is always recomputed.
ICMP reply packets received from the network are demultiplexed according
to their id's, and are returned by recv() without any modifications.
IP header information and ICMP errors of those packets may be obtained
via ancillary data (IP_RECVTTL, IP_RETOPTS, and IP_RECVERR). ICMP source
quenches and redirects are reported as fake errors via the error queue
(IP_RECVERR); the next hop address for redirects is saved to ee_info (in
network order).
socket(2) is restricted to the group range specified in
"/proc/sys/net/ipv4/ping_group_range". It is "1 0" by default, meaning
that nobody (not even root) may create ping sockets. Setting it to "100
100" would grant permissions to the single group (to either make
/sbin/ping g+s and owned by this group or to grant permissions to the
"netadmins" group), "0 4294967295" would enable it for the world, "100
4294967295" would enable it for the users, but not daemons.
The existing code might be (in the unlikely case anyone needs it)
extended rather easily to handle other similar pairs of ICMP messages
(Timestamp/Reply, Information Request/Reply, Address Mask Request/Reply
etc.).
Userspace ping util & patch for it:
http://openwall.info/wiki/people/segoon/ping
For Openwall GNU/*/Linux it was the last step on the road to the
setuid-less distro. A revision of this patch (for RHEL5/OpenVZ kernels)
is in use in Owl-current, such as in the 2011/03/12 LiveCD ISOs:
http://mirrors.kernel.org/openwall/Owl/current/iso/
Initially this functionality was written by Pavel Kankovsky for
Linux 2.4.32, but unfortunately it was never made public.
All ping options (-b, -p, -Q, -R, -s, -t, -T, -M, -I), are tested with
the patch.
PATCH v3:
- switched to flowi4.
- minor changes to be consistent with raw sockets code.
PATCH v2:
- changed ping_debug() to pr_debug().
- removed CONFIG_IP_PING.
- removed ping_seq_fops.owner field (unused for procfs).
- switched to proc_net_fops_create().
- switched to %pK in seq_printf().
PATCH v1:
- fixed checksumming bug.
- CAP_NET_RAW may not create icmp sockets anymore.
RFC v2:
- minor cleanups.
- introduced sysctl'able group range to restrict socket(2).
Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-05-13 12:01:00 +02:00
|
|
|
inet_fragment.o ping.o
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2007-12-05 10:38:23 +01:00
|
|
|
obj-$(CONFIG_SYSCTL) += sysctl_net_ipv4.o
|
2007-04-25 06:53:35 +02:00
|
|
|
obj-$(CONFIG_PROC_FS) += proc.o
|
2005-04-17 00:20:36 +02:00
|
|
|
obj-$(CONFIG_IP_MULTIPLE_TABLES) += fib_rules.o
|
|
|
|
|
obj-$(CONFIG_IP_MROUTE) += ipmr.o
|
|
|
|
|
obj-$(CONFIG_NET_IPIP) += ipip.o
|
2010-08-22 08:05:39 +02:00
|
|
|
obj-$(CONFIG_NET_IPGRE_DEMUX) += gre.o
|
2005-04-17 00:20:36 +02:00
|
|
|
obj-$(CONFIG_NET_IPGRE) += ip_gre.o
|
|
|
|
|
obj-$(CONFIG_SYN_COOKIES) += syncookies.o
|
|
|
|
|
obj-$(CONFIG_INET_AH) += ah4.o
|
|
|
|
|
obj-$(CONFIG_INET_ESP) += esp4.o
|
|
|
|
|
obj-$(CONFIG_INET_IPCOMP) += ipcomp.o
|
2006-03-28 11:12:13 +02:00
|
|
|
obj-$(CONFIG_INET_XFRM_TUNNEL) += xfrm4_tunnel.o
|
2006-10-04 08:47:05 +02:00
|
|
|
obj-$(CONFIG_INET_XFRM_MODE_BEET) += xfrm4_mode_beet.o
|
2007-08-09 07:38:05 +02:00
|
|
|
obj-$(CONFIG_INET_LRO) += inet_lro.o
|
2006-03-28 11:12:13 +02:00
|
|
|
obj-$(CONFIG_INET_TUNNEL) += tunnel4.o
|
2006-05-28 08:05:54 +02:00
|
|
|
obj-$(CONFIG_INET_XFRM_MODE_TRANSPORT) += xfrm4_mode_transport.o
|
|
|
|
|
obj-$(CONFIG_INET_XFRM_MODE_TUNNEL) += xfrm4_mode_tunnel.o
|
2005-04-17 00:20:36 +02:00
|
|
|
obj-$(CONFIG_IP_PNP) += ipconfig.o
|
2006-01-10 01:43:13 +01:00
|
|
|
obj-$(CONFIG_NETFILTER) += netfilter.o netfilter/
|
[INET_DIAG]: Move the tcp_diag interface to the proper place
With this the previous setup is back, i.e. tcp_diag can be built as a module,
as dccp_diag and both share the infrastructure available in inet_diag.
If one selects CONFIG_INET_DIAG as module CONFIG_INET_TCP_DIAG will also be
built as a module, as will CONFIG_INET_DCCP_DIAG, if CONFIG_IP_DCCP was
selected static or as a module, if CONFIG_INET_DIAG is y, being statically
linked CONFIG_INET_TCP_DIAG will follow suit and CONFIG_INET_DCCP_DIAG will be
built in the same manner as CONFIG_IP_DCCP.
Now to aim at UDP, converting it to use inet_hashinfo, so that we can use
iproute2 for UDP sockets as well.
Ah, just to show an example of this new infrastructure working for DCCP :-)
[root@qemu ~]# ./ss -dane
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 0 *:5001 *:* ino:942 sk:cfd503a0
ESTAB 0 0 127.0.0.1:5001 127.0.0.1:32770 ino:943 sk:cfd50a60
ESTAB 0 0 127.0.0.1:32770 127.0.0.1:5001 ino:947 sk:cfd50700
TIME-WAIT 0 0 127.0.0.1:32769 127.0.0.1:5001 timer:(timewait,3.430ms,0) ino:0 sk:cf209620
Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-08-12 17:59:17 +02:00
|
|
|
obj-$(CONFIG_INET_DIAG) += inet_diag.o
|
|
|
|
|
obj-$(CONFIG_INET_TCP_DIAG) += tcp_diag.o
|
2006-06-06 02:30:32 +02:00
|
|
|
obj-$(CONFIG_NET_TCPPROBE) += tcp_probe.o
|
2005-06-23 21:23:25 +02:00
|
|
|
obj-$(CONFIG_TCP_CONG_BIC) += tcp_bic.o
|
2005-12-14 08:13:28 +01:00
|
|
|
obj-$(CONFIG_TCP_CONG_CUBIC) += tcp_cubic.o
|
2005-06-23 21:24:09 +02:00
|
|
|
obj-$(CONFIG_TCP_CONG_WESTWOOD) += tcp_westwood.o
|
2005-06-23 21:24:58 +02:00
|
|
|
obj-$(CONFIG_TCP_CONG_HSTCP) += tcp_highspeed.o
|
[TCP]: Add TCP Hybla congestion control module.
TCP Hybla congestion avoidance.
- "In heterogeneous networks, TCP connections that incorporate a
terrestrial or satellite radio link are greatly disadvantaged with
respect to entirely wired connections, because of their longer round
trip times (RTTs). To cope with this problem, a new TCP proposal, the
TCP Hybla, is presented and discussed in the paper[1]. It stems from an
analytical evaluation of the congestion window dynamics in the TCP
standard versions (Tahoe, Reno, NewReno), which suggests the necessary
modifications to remove the performance dependence on RTT.[...]"[1]
[1]: Carlo Caini, Rosario Firrincieli, "TCP Hybla: a TCP enhancement for
heterogeneous networks",
International Journal of Satellite Communications and Networking
Volume 22, Issue 5 , Pages 547 - 566. September 2004.
Signed-off-by: Daniele Lacamera (root at danielinux.net)net
Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-06-23 21:26:34 +02:00
|
|
|
obj-$(CONFIG_TCP_CONG_HYBLA) += tcp_hybla.o
|
2005-06-23 21:28:11 +02:00
|
|
|
obj-$(CONFIG_TCP_CONG_HTCP) += tcp_htcp.o
|
2005-06-23 21:27:19 +02:00
|
|
|
obj-$(CONFIG_TCP_CONG_VEGAS) += tcp_vegas.o
|
2006-06-06 02:28:30 +02:00
|
|
|
obj-$(CONFIG_TCP_CONG_VENO) += tcp_veno.o
|
2005-06-23 21:29:07 +02:00
|
|
|
obj-$(CONFIG_TCP_CONG_SCALABLE) += tcp_scalable.o
|
2006-06-06 02:27:58 +02:00
|
|
|
obj-$(CONFIG_TCP_CONG_LP) += tcp_lp.o
|
2007-02-22 09:23:05 +01:00
|
|
|
obj-$(CONFIG_TCP_CONG_YEAH) += tcp_yeah.o
|
2007-04-21 02:07:51 +02:00
|
|
|
obj-$(CONFIG_TCP_CONG_ILLINOIS) += tcp_illinois.o
|
2006-08-04 01:48:06 +02:00
|
|
|
obj-$(CONFIG_NETLABEL) += cipso_ipv4.o
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
|
obj-$(CONFIG_XFRM) += xfrm4_policy.o xfrm4_state.o xfrm4_input.o \
|
|
|
|
|
xfrm4_output.o
|