Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 371f1c7e authored by David S. Miller's avatar David S. Miller
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next 



Pablo Neira Ayuso says:

====================
Netfilter/IPVS updates for net-next

The following patchset contains Netfilter/IPVS updates for your net-next
tree. Most relevantly, updates for the nfnetlink_log to integrate with
conntrack, fixes for cttimeout and improvements for nf_queue core, they are:

1) Remove useless ifdef around static inline function in IPVS, from
   Eric W. Biederman.

2) Simplify the conntrack support for nfnetlink_queue: Merge
   nfnetlink_queue_ct.c file into nfnetlink_queue_core.c, then rename it back
   to nfnetlink_queue.c

3) Use y2038 safe timestamp from nfnetlink_queue.

4) Get rid of dead function definition in nf_conntrack, from Flavio
   Leitner.

5) Attach conntrack support for nfnetlink_log.c, from Ken-ichirou MATSUZAWA.
   This adds a new NETFILTER_NETLINK_GLUE_CT Kconfig switch that
   controls enabling both nfqueue and nflog integration with conntrack.
   The userspace application can request this via NFULNL_CFG_F_CONNTRACK
   configuration flag.

6) Remove unused netns variables in IPVS, from Eric W. Biederman and
   Simon Horman.

7) Don't put back the refcount on the cttimeout object from xt_CT on success.

8) Fix crash on cttimeout policy object removal. We have to flush out
   the cttimeout extension area of the conntrack not to refer to an unexisting
   object that was just removed.

9) Make sure rcu_callback completion before removing nfnetlink_cttimeout
   module removal.

10) Fix compilation warning in br_netfilter when no nf_defrag_ipv4 and
    nf_defrag_ipv6 are enabled. Patch from Arnd Bergmann.

11) Autoload ctnetlink dependencies when NFULNL_CFG_F_CONNTRACK is
    requested. Again from Ken-ichirou MATSUZAWA.

12) Don't use pointer to previous hook when reinjecting traffic via
    nf_queue with NF_REPEAT verdict since it may be already gone. This
    also avoids a deadloop if the userspace application keeps returning
    NF_REPEAT.

13) A bunch of cleanups for netfilter IPv4 and IPv6 code from Ian Morris.

14) Consolidate logger instance existence check in nfulnl_recv_config().

15) Fix broken atomicity when applying configuration updates to logger
    instances in nfnetlink_log.

16) Get rid of the .owner attribute in our hook object. We don't need
    this anymore since we're dropping pending packets that have escaped
    from the kernel when unremoving the hook. Patch from Florian Westphal.

17) Remove unnecessary rcu_read_lock() from nf_reinject code, we always
    assume RCU read side lock from .call_rcu in nfnetlink. Also from Florian.

18) Use static inline function instead of macros to define NF_HOOK() and
    NF_HOOK_COND() when no netfilter support in on, from Arnd Bergmann.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 7b4b0009 f0a0a978

include/linux/netfilter.h

+27 −9
Original line number Diff line number Diff line
@@ -90,7 +90,6 @@ struct nf_hook_ops { 
	/* User fills in from here down. */

	nf_hookfn		*hook;

	struct net_device	*dev;

	struct module		*owner;

	void			*priv;

	u_int8_t		pf;

	unsigned int		hooknum;
@@ -347,8 +346,23 @@ nf_nat_decode_session(struct sk_buff *skb, struct flowi *fl, u_int8_t family) 
}



#else /* !CONFIG_NETFILTER */

#define NF_HOOK(pf, hook, net, sk, skb, indev, outdev, okfn) (okfn)(net, sk, skb)

#define NF_HOOK_COND(pf, hook, net, sk, skb, indev, outdev, okfn, cond) (okfn)(net, sk, skb)

static inline int

NF_HOOK_COND(uint8_t pf, unsigned int hook, struct net *net, struct sock *sk,

	     struct sk_buff *skb, struct net_device *in, struct net_device *out,

	     int (*okfn)(struct net *, struct sock *, struct sk_buff *),

	     bool cond)

{

	return okfn(net, sk, skb);

}



static inline int

NF_HOOK(uint8_t pf, unsigned int hook, struct net *net, struct sock *sk,

	struct sk_buff *skb, struct net_device *in, struct net_device *out,

	int (*okfn)(struct net *, struct sock *, struct sk_buff *))

{

	return okfn(net, sk, skb);

}



static inline int nf_hook(u_int8_t pf, unsigned int hook, struct net *net,

			  struct sock *sk, struct sk_buff *skb,

			  struct net_device *indev, struct net_device *outdev,
@@ -369,24 +383,28 @@ nf_nat_decode_session(struct sk_buff *skb, struct flowi *fl, u_int8_t family) 
extern void (*ip_ct_attach)(struct sk_buff *, const struct sk_buff *) __rcu;

void nf_ct_attach(struct sk_buff *, const struct sk_buff *);

extern void (*nf_ct_destroy)(struct nf_conntrack *) __rcu;

#else

static inline void nf_ct_attach(struct sk_buff *new, struct sk_buff *skb) {}

#endif



struct nf_conn;

enum ip_conntrack_info;

struct nlattr;



struct nfq_ct_hook {

struct nfnl_ct_hook {

	struct nf_conn *(*get_ct)(const struct sk_buff *skb,

				  enum ip_conntrack_info *ctinfo);

	size_t (*build_size)(const struct nf_conn *ct);

	int (*build)(struct sk_buff *skb, struct nf_conn *ct);

	int (*build)(struct sk_buff *skb, struct nf_conn *ct,

		     enum ip_conntrack_info ctinfo,

		     u_int16_t ct_attr, u_int16_t ct_info_attr);

	int (*parse)(const struct nlattr *attr, struct nf_conn *ct);

	int (*attach_expect)(const struct nlattr *attr, struct nf_conn *ct,

			     u32 portid, u32 report);

	void (*seq_adjust)(struct sk_buff *skb, struct nf_conn *ct,

			   enum ip_conntrack_info ctinfo, s32 off);

};

extern struct nfq_ct_hook __rcu *nfq_ct_hook;

#else

static inline void nf_ct_attach(struct sk_buff *new, struct sk_buff *skb) {}

#endif

extern struct nfnl_ct_hook __rcu *nfnl_ct_hook;



/**

 * nf_skb_duplicated - TEE target has sent a packet

include/net/netfilter/nf_conntrack.h

+0 −4
Original line number Diff line number Diff line
@@ -183,10 +183,6 @@ void *nf_ct_alloc_hashtable(unsigned int *sizep, int nulls); 


void nf_ct_free_hashtable(void *hash, unsigned int size);



struct nf_conntrack_tuple_hash *

__nf_conntrack_find(struct net *net, u16 zone,

		    const struct nf_conntrack_tuple *tuple);



int nf_conntrack_hash_check_insert(struct nf_conn *ct);

bool nf_ct_delete(struct nf_conn *ct, u32 pid, int report);

include/net/netfilter/nf_conntrack_timeout.h

+19 −6
Original line number Diff line number Diff line
@@ -20,10 +20,20 @@ struct ctnl_timeout { 
};



struct nf_conn_timeout {

	struct ctnl_timeout	*timeout;

	struct ctnl_timeout __rcu *timeout;

};



#define NF_CT_TIMEOUT_EXT_DATA(__t) (unsigned int *) &((__t)->timeout->data)

static inline unsigned int *

nf_ct_timeout_data(struct nf_conn_timeout *t)

{

	struct ctnl_timeout *timeout;



	timeout = rcu_dereference(t->timeout);

	if (timeout == NULL)

		return NULL;



	return (unsigned int *)timeout->data;

}



static inline

struct nf_conn_timeout *nf_ct_timeout_find(const struct nf_conn *ct)
@@ -47,7 +57,7 @@ struct nf_conn_timeout *nf_ct_timeout_ext_add(struct nf_conn *ct, 
	if (timeout_ext == NULL)

		return NULL;



	timeout_ext->timeout = timeout;

	rcu_assign_pointer(timeout_ext->timeout, timeout);



	return timeout_ext;

#else
@@ -64,10 +74,13 @@ nf_ct_timeout_lookup(struct net *net, struct nf_conn *ct, 
	unsigned int *timeouts;



	timeout_ext = nf_ct_timeout_find(ct);

	if (timeout_ext)

		timeouts = NF_CT_TIMEOUT_EXT_DATA(timeout_ext);

	else

	if (timeout_ext) {

		timeouts = nf_ct_timeout_data(timeout_ext);

		if (unlikely(!timeouts))

			timeouts = l4proto->get_timeouts(net);

	} else {

		timeouts = l4proto->get_timeouts(net);

	}



	return timeouts;

#else

include/net/netfilter/nf_queue.h

+1 −1
Original line number Diff line number Diff line
@@ -32,7 +32,7 @@ void nf_register_queue_handler(const struct nf_queue_handler *qh); 
void nf_unregister_queue_handler(void);

void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict);



bool nf_queue_entry_get_refs(struct nf_queue_entry *entry);

void nf_queue_entry_get_refs(struct nf_queue_entry *entry);

void nf_queue_entry_release_refs(struct nf_queue_entry *entry);



static inline void init_hashrandom(u32 *jhash_initval)

include/net/netfilter/nfnetlink_queue.h

deleted100644 → 0
+0 −51
Original line number Diff line number Diff line 
#ifndef _NET_NFNL_QUEUE_H_

#define _NET_NFNL_QUEUE_H_



#include <linux/netfilter/nf_conntrack_common.h>



struct nf_conn;



#ifdef CONFIG_NETFILTER_NETLINK_QUEUE_CT

struct nf_conn *nfqnl_ct_get(struct sk_buff *entskb, size_t *size,

			     enum ip_conntrack_info *ctinfo);

struct nf_conn *nfqnl_ct_parse(const struct sk_buff *skb,

			       const struct nlattr *attr,

			       enum ip_conntrack_info *ctinfo);

int nfqnl_ct_put(struct sk_buff *skb, struct nf_conn *ct,

		 enum ip_conntrack_info ctinfo);

void nfqnl_ct_seq_adjust(struct sk_buff *skb, struct nf_conn *ct,

			 enum ip_conntrack_info ctinfo, int diff);

int nfqnl_attach_expect(struct nf_conn *ct, const struct nlattr *attr,

			u32 portid, u32 report);

#else

inline struct nf_conn *

nfqnl_ct_get(struct sk_buff *entskb, size_t *size, enum ip_conntrack_info *ctinfo)

{

	return NULL;

}



inline struct nf_conn *nfqnl_ct_parse(const struct sk_buff *skb,

				      const struct nlattr *attr,

				      enum ip_conntrack_info *ctinfo)

{

	return NULL;

}



inline int

nfqnl_ct_put(struct sk_buff *skb, struct nf_conn *ct, enum ip_conntrack_info ctinfo)

{

	return 0;

}



inline void nfqnl_ct_seq_adjust(struct sk_buff *skb, struct nf_conn *ct,

				enum ip_conntrack_info ctinfo, int diff)

{

}



inline int nfqnl_attach_expect(struct nf_conn *ct, const struct nlattr *attr,

			       u32 portid, u32 report)

{

	return 0;

}

#endif /* NF_CONNTRACK */

#endif