Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c162610c authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next 



Pablo Neira Ayuso says:

====================
Netfilter/IPVS updates for net-next

The following patchset contains Netfilter/IPVS updates for net-next:

1) Rename mss field to mss_option field in synproxy, from Fernando Mancera.

2) Use SYSCTL_{ZERO,ONE} definitions in conntrack, from Matteo Croce.

3) More strict validation of IPVS sysctl values, from Junwei Hu.

4) Remove unnecessary spaces after on the right hand side of assignments,
   from yangxingwu.

5) Add offload support for bitwise operation.

6) Extend the nft_offload_reg structure to store immediate date.

7) Collapse several ip_set header files into ip_set.h, from
   Jeremy Sowden.

8) Make netfilter headers compile with CONFIG_KERNEL_HEADER_TEST=y,
   from Jeremy Sowden.

9) Fix several sparse warnings due to missing prototypes, from
   Valdis Kletnieks.

10) Use static lock initialiser to ensure connlabel spinlock is
    initialized on boot time to fix sched/act_ct.c, patch
    from Florian Westphal.
====================

Signed-off-by: default avatarJakub Kicinski <jakub.kicinski@netronome.com>
parents b753c5a7 10533343

include/Kbuild

+0 −74
Original line number Diff line number Diff line
@@ -386,31 +386,6 @@ header-test- += linux/mvebu-pmsu.h 
header-test-			+= linux/mxm-wmi.h

header-test-			+= linux/n_r3964.h

header-test-			+= linux/ndctl.h

header-test-			+= linux/netfilter/ipset/ip_set.h

header-test-			+= linux/netfilter/ipset/ip_set_bitmap.h

header-test-			+= linux/netfilter/ipset/ip_set_comment.h

header-test-			+= linux/netfilter/ipset/ip_set_counter.h

header-test-			+= linux/netfilter/ipset/ip_set_getport.h

header-test-			+= linux/netfilter/ipset/ip_set_hash.h

header-test-			+= linux/netfilter/ipset/ip_set_list.h

header-test-			+= linux/netfilter/ipset/ip_set_skbinfo.h

header-test-			+= linux/netfilter/ipset/ip_set_timeout.h

header-test-			+= linux/netfilter/nf_conntrack_amanda.h

header-test-			+= linux/netfilter/nf_conntrack_ftp.h

header-test-			+= linux/netfilter/nf_conntrack_h323.h

header-test-			+= linux/netfilter/nf_conntrack_h323_asn1.h

header-test-			+= linux/netfilter/nf_conntrack_irc.h

header-test-			+= linux/netfilter/nf_conntrack_pptp.h

header-test-			+= linux/netfilter/nf_conntrack_proto_gre.h

header-test-			+= linux/netfilter/nf_conntrack_sip.h

header-test-			+= linux/netfilter/nf_conntrack_snmp.h

header-test-			+= linux/netfilter/nf_conntrack_tftp.h

header-test-			+= linux/netfilter/x_tables.h

header-test-			+= linux/netfilter_arp/arp_tables.h

header-test-			+= linux/netfilter_bridge/ebtables.h

header-test-			+= linux/netfilter_ipv4/ip4_tables.h

header-test-			+= linux/netfilter_ipv4/ip_tables.h

header-test-			+= linux/netfilter_ipv6/ip6_tables.h

header-test-			+= linux/nfs.h

header-test-			+= linux/nfs_fs_i.h

header-test-			+= linux/nfs_fs_sb.h
@@ -874,43 +849,6 @@ header-test- += net/mpls_iptunnel.h 
header-test-			+= net/mrp.h

header-test-			+= net/ncsi.h

header-test-			+= net/netevent.h

header-test-			+= net/netfilter/br_netfilter.h

header-test-			+= net/netfilter/ipv4/nf_dup_ipv4.h

header-test-			+= net/netfilter/ipv6/nf_defrag_ipv6.h

header-test-			+= net/netfilter/ipv6/nf_dup_ipv6.h

header-test-			+= net/netfilter/nf_conntrack.h

header-test-			+= net/netfilter/nf_conntrack_acct.h

header-test-			+= net/netfilter/nf_conntrack_bridge.h

header-test-			+= net/netfilter/nf_conntrack_core.h

header-test-			+= net/netfilter/nf_conntrack_count.h

header-test-			+= net/netfilter/nf_conntrack_ecache.h

header-test-			+= net/netfilter/nf_conntrack_expect.h

header-test-			+= net/netfilter/nf_conntrack_extend.h

header-test-			+= net/netfilter/nf_conntrack_helper.h

header-test-			+= net/netfilter/nf_conntrack_l4proto.h

header-test-			+= net/netfilter/nf_conntrack_labels.h

header-test-			+= net/netfilter/nf_conntrack_seqadj.h

header-test-			+= net/netfilter/nf_conntrack_synproxy.h

header-test-			+= net/netfilter/nf_conntrack_timeout.h

header-test-			+= net/netfilter/nf_conntrack_timestamp.h

header-test-			+= net/netfilter/nf_conntrack_tuple.h

header-test-			+= net/netfilter/nf_dup_netdev.h

header-test-			+= net/netfilter/nf_flow_table.h

header-test-			+= net/netfilter/nf_nat.h

header-test-			+= net/netfilter/nf_nat_helper.h

header-test-			+= net/netfilter/nf_nat_masquerade.h

header-test-			+= net/netfilter/nf_nat_redirect.h

header-test-			+= net/netfilter/nf_queue.h

header-test-			+= net/netfilter/nf_reject.h

header-test-			+= net/netfilter/nf_synproxy.h

header-test-$(CONFIG_NF_TABLES)	+= net/netfilter/nf_tables.h

header-test-$(CONFIG_NF_TABLES)	+= net/netfilter/nf_tables_core.h

header-test-$(CONFIG_NF_TABLES)	+= net/netfilter/nf_tables_ipv4.h

header-test-			+= net/netfilter/nf_tables_ipv6.h

header-test-$(CONFIG_NF_TABLES)	+= net/netfilter/nf_tables_offload.h

header-test-			+= net/netfilter/nft_fib.h

header-test-			+= net/netfilter/nft_meta.h

header-test-			+= net/netfilter/nft_reject.h

header-test-			+= net/netns/can.h

header-test-			+= net/netns/generic.h

header-test-			+= net/netns/ieee802154_6lowpan.h
@@ -1140,18 +1078,6 @@ header-test- += uapi/linux/kvm_para.h 
header-test-			+= uapi/linux/lightnvm.h

header-test-			+= uapi/linux/mic_common.h

header-test-			+= uapi/linux/mman.h

header-test-			+= uapi/linux/netfilter/ipset/ip_set_bitmap.h

header-test-			+= uapi/linux/netfilter/ipset/ip_set_hash.h

header-test-			+= uapi/linux/netfilter/ipset/ip_set_list.h

header-test-			+= uapi/linux/netfilter/nf_synproxy.h

header-test-			+= uapi/linux/netfilter/xt_policy.h

header-test-			+= uapi/linux/netfilter/xt_set.h

header-test-			+= uapi/linux/netfilter_arp/arp_tables.h

header-test-			+= uapi/linux/netfilter_arp/arpt_mangle.h

header-test-			+= uapi/linux/netfilter_ipv4/ip_tables.h

header-test-			+= uapi/linux/netfilter_ipv4/ipt_LOG.h

header-test-			+= uapi/linux/netfilter_ipv6/ip6_tables.h

header-test-			+= uapi/linux/netfilter_ipv6/ip6t_LOG.h

header-test-			+= uapi/linux/nilfs2_ondisk.h

header-test-			+= uapi/linux/patchkey.h

header-test-			+= uapi/linux/ptrace.h

include/linux/netfilter/ipset/ip_set.h

+234 −4
Original line number Diff line number Diff line
@@ -452,10 +452,240 @@ bitmap_bytes(u32 a, u32 b) 
	return 4 * ((((b - a + 8) / 8) + 3) / 4);

}



#include <linux/netfilter/ipset/ip_set_timeout.h>

#include <linux/netfilter/ipset/ip_set_comment.h>

#include <linux/netfilter/ipset/ip_set_counter.h>

#include <linux/netfilter/ipset/ip_set_skbinfo.h>

/* How often should the gc be run by default */

#define IPSET_GC_TIME			(3 * 60)



/* Timeout period depending on the timeout value of the given set */

#define IPSET_GC_PERIOD(timeout) \

	((timeout/3) ? min_t(u32, (timeout)/3, IPSET_GC_TIME) : 1)



/* Entry is set with no timeout value */

#define IPSET_ELEM_PERMANENT	0



/* Set is defined with timeout support: timeout value may be 0 */

#define IPSET_NO_TIMEOUT	UINT_MAX



/* Max timeout value, see msecs_to_jiffies() in jiffies.h */

#define IPSET_MAX_TIMEOUT	(UINT_MAX >> 1)/MSEC_PER_SEC



#define ip_set_adt_opt_timeout(opt, set)	\

((opt)->ext.timeout != IPSET_NO_TIMEOUT ? (opt)->ext.timeout : (set)->timeout)



static inline unsigned int

ip_set_timeout_uget(struct nlattr *tb)

{

	unsigned int timeout = ip_set_get_h32(tb);



	/* Normalize to fit into jiffies */

	if (timeout > IPSET_MAX_TIMEOUT)

		timeout = IPSET_MAX_TIMEOUT;



	return timeout;

}



static inline bool

ip_set_timeout_expired(const unsigned long *t)

{

	return *t != IPSET_ELEM_PERMANENT && time_is_before_jiffies(*t);

}



static inline void

ip_set_timeout_set(unsigned long *timeout, u32 value)

{

	unsigned long t;



	if (!value) {

		*timeout = IPSET_ELEM_PERMANENT;

		return;

	}



	t = msecs_to_jiffies(value * MSEC_PER_SEC) + jiffies;

	if (t == IPSET_ELEM_PERMANENT)

		/* Bingo! :-) */

		t--;

	*timeout = t;

}



static inline u32

ip_set_timeout_get(const unsigned long *timeout)

{

	u32 t;



	if (*timeout == IPSET_ELEM_PERMANENT)

		return 0;



	t = jiffies_to_msecs(*timeout - jiffies)/MSEC_PER_SEC;

	/* Zero value in userspace means no timeout */

	return t == 0 ? 1 : t;

}



static inline char*

ip_set_comment_uget(struct nlattr *tb)

{

	return nla_data(tb);

}



/* Called from uadd only, protected by the set spinlock.

 * The kadt functions don't use the comment extensions in any way.

 */

static inline void

ip_set_init_comment(struct ip_set *set, struct ip_set_comment *comment,

		    const struct ip_set_ext *ext)

{

	struct ip_set_comment_rcu *c = rcu_dereference_protected(comment->c, 1);

	size_t len = ext->comment ? strlen(ext->comment) : 0;



	if (unlikely(c)) {

		set->ext_size -= sizeof(*c) + strlen(c->str) + 1;

		kfree_rcu(c, rcu);

		rcu_assign_pointer(comment->c, NULL);

	}

	if (!len)

		return;

	if (unlikely(len > IPSET_MAX_COMMENT_SIZE))

		len = IPSET_MAX_COMMENT_SIZE;

	c = kmalloc(sizeof(*c) + len + 1, GFP_ATOMIC);

	if (unlikely(!c))

		return;

	strlcpy(c->str, ext->comment, len + 1);

	set->ext_size += sizeof(*c) + strlen(c->str) + 1;

	rcu_assign_pointer(comment->c, c);

}



/* Used only when dumping a set, protected by rcu_read_lock() */

static inline int

ip_set_put_comment(struct sk_buff *skb, const struct ip_set_comment *comment)

{

	struct ip_set_comment_rcu *c = rcu_dereference(comment->c);



	if (!c)

		return 0;

	return nla_put_string(skb, IPSET_ATTR_COMMENT, c->str);

}



/* Called from uadd/udel, flush or the garbage collectors protected

 * by the set spinlock.

 * Called when the set is destroyed and when there can't be any user

 * of the set data anymore.

 */

static inline void

ip_set_comment_free(struct ip_set *set, struct ip_set_comment *comment)

{

	struct ip_set_comment_rcu *c;



	c = rcu_dereference_protected(comment->c, 1);

	if (unlikely(!c))

		return;

	set->ext_size -= sizeof(*c) + strlen(c->str) + 1;

	kfree_rcu(c, rcu);

	rcu_assign_pointer(comment->c, NULL);

}



static inline void

ip_set_add_bytes(u64 bytes, struct ip_set_counter *counter)

{

	atomic64_add((long long)bytes, &(counter)->bytes);

}



static inline void

ip_set_add_packets(u64 packets, struct ip_set_counter *counter)

{

	atomic64_add((long long)packets, &(counter)->packets);

}



static inline u64

ip_set_get_bytes(const struct ip_set_counter *counter)

{

	return (u64)atomic64_read(&(counter)->bytes);

}



static inline u64

ip_set_get_packets(const struct ip_set_counter *counter)

{

	return (u64)atomic64_read(&(counter)->packets);

}



static inline bool

ip_set_match_counter(u64 counter, u64 match, u8 op)

{

	switch (op) {

	case IPSET_COUNTER_NONE:

		return true;

	case IPSET_COUNTER_EQ:

		return counter == match;

	case IPSET_COUNTER_NE:

		return counter != match;

	case IPSET_COUNTER_LT:

		return counter < match;

	case IPSET_COUNTER_GT:

		return counter > match;

	}

	return false;

}



static inline void

ip_set_update_counter(struct ip_set_counter *counter,

		      const struct ip_set_ext *ext, u32 flags)

{

	if (ext->packets != ULLONG_MAX &&

	    !(flags & IPSET_FLAG_SKIP_COUNTER_UPDATE)) {

		ip_set_add_bytes(ext->bytes, counter);

		ip_set_add_packets(ext->packets, counter);

	}

}



static inline bool

ip_set_put_counter(struct sk_buff *skb, const struct ip_set_counter *counter)

{

	return nla_put_net64(skb, IPSET_ATTR_BYTES,

			     cpu_to_be64(ip_set_get_bytes(counter)),

			     IPSET_ATTR_PAD) ||

	       nla_put_net64(skb, IPSET_ATTR_PACKETS,

			     cpu_to_be64(ip_set_get_packets(counter)),

			     IPSET_ATTR_PAD);

}



static inline void

ip_set_init_counter(struct ip_set_counter *counter,

		    const struct ip_set_ext *ext)

{

	if (ext->bytes != ULLONG_MAX)

		atomic64_set(&(counter)->bytes, (long long)(ext->bytes));

	if (ext->packets != ULLONG_MAX)

		atomic64_set(&(counter)->packets, (long long)(ext->packets));

}



static inline void

ip_set_get_skbinfo(struct ip_set_skbinfo *skbinfo,

		   const struct ip_set_ext *ext,

		   struct ip_set_ext *mext, u32 flags)

{

	mext->skbinfo = *skbinfo;

}



static inline bool

ip_set_put_skbinfo(struct sk_buff *skb, const struct ip_set_skbinfo *skbinfo)

{

	/* Send nonzero parameters only */

	return ((skbinfo->skbmark || skbinfo->skbmarkmask) &&

		nla_put_net64(skb, IPSET_ATTR_SKBMARK,

			      cpu_to_be64((u64)skbinfo->skbmark << 32 |

					  skbinfo->skbmarkmask),

			      IPSET_ATTR_PAD)) ||

	       (skbinfo->skbprio &&

		nla_put_net32(skb, IPSET_ATTR_SKBPRIO,

			      cpu_to_be32(skbinfo->skbprio))) ||

	       (skbinfo->skbqueue &&

		nla_put_net16(skb, IPSET_ATTR_SKBQUEUE,

			      cpu_to_be16(skbinfo->skbqueue)));

}



static inline void

ip_set_init_skbinfo(struct ip_set_skbinfo *skbinfo,

		    const struct ip_set_ext *ext)

{

	*skbinfo = ext->skbinfo;

}



#define IP_SET_INIT_KEXT(skb, opt, set)			\

	{ .bytes = (skb)->len, .packets = 1,		\

include/linux/netfilter/ipset/ip_set_comment.h

deleted100644 → 0
+0 −73
Original line number Diff line number Diff line 
/* SPDX-License-Identifier: GPL-2.0-only */

#ifndef _IP_SET_COMMENT_H

#define _IP_SET_COMMENT_H



/* Copyright (C) 2013 Oliver Smith <oliver@8.c.9.b.0.7.4.0.1.0.0.2.ip6.arpa>

 */



#ifdef __KERNEL__



static inline char*

ip_set_comment_uget(struct nlattr *tb)

{

	return nla_data(tb);

}



/* Called from uadd only, protected by the set spinlock.

 * The kadt functions don't use the comment extensions in any way.

 */

static inline void

ip_set_init_comment(struct ip_set *set, struct ip_set_comment *comment,

		    const struct ip_set_ext *ext)

{

	struct ip_set_comment_rcu *c = rcu_dereference_protected(comment->c, 1);

	size_t len = ext->comment ? strlen(ext->comment) : 0;



	if (unlikely(c)) {

		set->ext_size -= sizeof(*c) + strlen(c->str) + 1;

		kfree_rcu(c, rcu);

		rcu_assign_pointer(comment->c, NULL);

	}

	if (!len)

		return;

	if (unlikely(len > IPSET_MAX_COMMENT_SIZE))

		len = IPSET_MAX_COMMENT_SIZE;

	c = kmalloc(sizeof(*c) + len + 1, GFP_ATOMIC);

	if (unlikely(!c))

		return;

	strlcpy(c->str, ext->comment, len + 1);

	set->ext_size += sizeof(*c) + strlen(c->str) + 1;

	rcu_assign_pointer(comment->c, c);

}



/* Used only when dumping a set, protected by rcu_read_lock() */

static inline int

ip_set_put_comment(struct sk_buff *skb, const struct ip_set_comment *comment)

{

	struct ip_set_comment_rcu *c = rcu_dereference(comment->c);



	if (!c)

		return 0;

	return nla_put_string(skb, IPSET_ATTR_COMMENT, c->str);

}



/* Called from uadd/udel, flush or the garbage collectors protected

 * by the set spinlock.

 * Called when the set is destroyed and when there can't be any user

 * of the set data anymore.

 */

static inline void

ip_set_comment_free(struct ip_set *set, struct ip_set_comment *comment)

{

	struct ip_set_comment_rcu *c;



	c = rcu_dereference_protected(comment->c, 1);

	if (unlikely(!c))

		return;

	set->ext_size -= sizeof(*c) + strlen(c->str) + 1;

	kfree_rcu(c, rcu);

	rcu_assign_pointer(comment->c, NULL);

}



#endif

#endif

include/linux/netfilter/ipset/ip_set_counter.h

deleted100644 → 0
+0 −84
Original line number Diff line number Diff line 
/* SPDX-License-Identifier: GPL-2.0-only */

#ifndef _IP_SET_COUNTER_H

#define _IP_SET_COUNTER_H



/* Copyright (C) 2015 Jozsef Kadlecsik <kadlec@netfilter.org> */



#ifdef __KERNEL__



static inline void

ip_set_add_bytes(u64 bytes, struct ip_set_counter *counter)

{

	atomic64_add((long long)bytes, &(counter)->bytes);

}



static inline void

ip_set_add_packets(u64 packets, struct ip_set_counter *counter)

{

	atomic64_add((long long)packets, &(counter)->packets);

}



static inline u64

ip_set_get_bytes(const struct ip_set_counter *counter)

{

	return (u64)atomic64_read(&(counter)->bytes);

}



static inline u64

ip_set_get_packets(const struct ip_set_counter *counter)

{

	return (u64)atomic64_read(&(counter)->packets);

}



static inline bool

ip_set_match_counter(u64 counter, u64 match, u8 op)

{

	switch (op) {

	case IPSET_COUNTER_NONE:

		return true;

	case IPSET_COUNTER_EQ:

		return counter == match;

	case IPSET_COUNTER_NE:

		return counter != match;

	case IPSET_COUNTER_LT:

		return counter < match;

	case IPSET_COUNTER_GT:

		return counter > match;

	}

	return false;

}



static inline void

ip_set_update_counter(struct ip_set_counter *counter,

		      const struct ip_set_ext *ext, u32 flags)

{

	if (ext->packets != ULLONG_MAX &&

	    !(flags & IPSET_FLAG_SKIP_COUNTER_UPDATE)) {

		ip_set_add_bytes(ext->bytes, counter);

		ip_set_add_packets(ext->packets, counter);

	}

}



static inline bool

ip_set_put_counter(struct sk_buff *skb, const struct ip_set_counter *counter)

{

	return nla_put_net64(skb, IPSET_ATTR_BYTES,

			     cpu_to_be64(ip_set_get_bytes(counter)),

			     IPSET_ATTR_PAD) ||

	       nla_put_net64(skb, IPSET_ATTR_PACKETS,

			     cpu_to_be64(ip_set_get_packets(counter)),

			     IPSET_ATTR_PAD);

}



static inline void

ip_set_init_counter(struct ip_set_counter *counter,

		    const struct ip_set_ext *ext)

{

	if (ext->bytes != ULLONG_MAX)

		atomic64_set(&(counter)->bytes, (long long)(ext->bytes));

	if (ext->packets != ULLONG_MAX)

		atomic64_set(&(counter)->packets, (long long)(ext->packets));

}



#endif /* __KERNEL__ */

#endif /* _IP_SET_COUNTER_H */

include/linux/netfilter/ipset/ip_set_getport.h

+4 −0
Original line number Diff line number Diff line
@@ -2,6 +2,10 @@ 
#ifndef _IP_SET_GETPORT_H

#define _IP_SET_GETPORT_H



#include <linux/skbuff.h>

#include <linux/types.h>

#include <uapi/linux/in.h>



extern bool ip_set_get_ip4_port(const struct sk_buff *skb, bool src,

				__be16 *port, u8 *proto);