Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 52a623bd authored by David S. Miller's avatar David S. Miller
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next 



Pablo Neira Ayuso says:

====================
Netfilter updates for net-next

The following patchset contains Netfilter updates for your net-next
tree. This batch contains connection tracking updates for the cleanup
iteration path, patches from Florian Westphal:

X) Skip unconfirmed conntracks in nf_ct_iterate_cleanup_net(), just set
   dying bit to let the CPU release them.

X) Add nf_ct_iterate_destroy() to be used on module removal, to kill
   conntrack from all namespace.

X) Restart iteration on hashtable resizing, since both may occur at
   the same time.

X) Use the new nf_ct_iterate_destroy() to remove conntrack with NAT
   mapping on module removal.

X) Use nf_ct_iterate_destroy() to remove conntrack entries helper
   module removal, from Liping Zhang.

X) Use nf_ct_iterate_cleanup_net() to remove the timeout extension
   if user requests this, also from Liping.

X) Add net_ns_barrier() and use it from FTP helper, so make sure
   no concurrent namespace removal happens at the same time while
   the helper module is being removed.

X) Use NFPROTO_MAX in layer 3 conntrack protocol array, to reduce
   module size. Same thing in nf_tables.

Updates for the nf_tables infrastructure:

X) Prepare usage of the extended ACK reporting infrastructure for
   nf_tables.

X) Remove unnecessary forward declaration in nf_tables hash set.

X) Skip set size estimation if number of element is not specified.

X) Changes to accomodate a (faster) unresizable hash set implementation,
   for anonymous sets and dynamic size fixed sets with no timeouts.

X) Faster lookup function for unresizable hash table for 2 and 4
   bytes key.

And, finally, a bunch of asorted small updates and cleanups:

X) Do not hold reference to netdev from ipt_CLUSTER, instead subscribe
   to device events and look up for index from the packet path, this
   is fixing an issue that is present since the very beginning, patch
   from Xin Long.

X) Use nf_register_net_hook() in ipt_CLUSTER, from Florian Westphal.

X) Use ebt_invalid_target() whenever possible in the ebtables tree,
   from Gao Feng.

X) Calm down compilation warning in nf_dup infrastructure, patch from
   stephen hemminger.

X) Statify functions in nftables rt expression, also from stephen.

X) Update Makefile to use canonical method to specify nf_tables-objs.
   From Jike Song.

X) Use nf_conntrack_helpers_register() in amanda and H323.

X) Space cleanup for ctnetlink, from linzhang.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents fcce2fdb 04ba724b

include/linux/netfilter/nfnetlink.h

+6 −4
Original line number Diff line number Diff line 
#ifndef _NFNETLINK_H

#define _NFNETLINK_H





#include <linux/netlink.h>

#include <linux/capability.h>

#include <net/netlink.h>
@@ -10,13 +9,16 @@ 
struct nfnl_callback {

	int (*call)(struct net *net, struct sock *nl, struct sk_buff *skb,

		    const struct nlmsghdr *nlh,

		    const struct nlattr * const cda[]);

		    const struct nlattr * const cda[],

		    struct netlink_ext_ack *extack);

	int (*call_rcu)(struct net *net, struct sock *nl, struct sk_buff *skb,

			const struct nlmsghdr *nlh,

			const struct nlattr * const cda[]);

			const struct nlattr * const cda[],

			struct netlink_ext_ack *extack);

	int (*call_batch)(struct net *net, struct sock *nl, struct sk_buff *skb,

			  const struct nlmsghdr *nlh,

			  const struct nlattr * const cda[]);

			  const struct nlattr * const cda[],

			  struct netlink_ext_ack *extack);

	const struct nla_policy *policy;	/* netlink attribute policy */

	const u_int16_t attr_count;		/* number of nlattr's */

};

include/linux/netfilter_bridge/ebtables.h

+0 −2
Original line number Diff line number Diff line
@@ -122,8 +122,6 @@ extern unsigned int ebt_do_table(struct sk_buff *skb, 
#define BASE_CHAIN (par->hook_mask & (1 << NF_BR_NUMHOOKS))

/* Clear the bit in the hook mask that tells if the rule is on a base chain */

#define CLEAR_BASE_CHAIN_BIT (par->hook_mask &= ~(1 << NF_BR_NUMHOOKS))

/* True if the target is not a standard target */

#define INVALID_TARGET (info->target < -NUM_STANDARD_TARGETS || info->target >= 0)



static inline bool ebt_invalid_target(int target)

{

include/net/net_namespace.h

+3 −0
Original line number Diff line number Diff line
@@ -158,6 +158,7 @@ extern struct net init_net; 
struct net *copy_net_ns(unsigned long flags, struct user_namespace *user_ns,

			struct net *old_net);



void net_ns_barrier(void);

#else /* CONFIG_NET_NS */

#include <linux/sched.h>

#include <linux/nsproxy.h>
@@ -168,6 +169,8 @@ static inline struct net *copy_net_ns(unsigned long flags, 
		return ERR_PTR(-EINVAL);

	return old_net;

}



static inline void net_ns_barrier(void) {}

#endif /* CONFIG_NET_NS */

include/net/netfilter/nf_conntrack.h

+7 −3
Original line number Diff line number Diff line
@@ -225,10 +225,14 @@ extern s32 (*nf_ct_nat_offset)(const struct nf_conn *ct, 
			       u32 seq);



/* Iterate over all conntracks: if iter returns true, it's deleted. */

void nf_ct_iterate_cleanup(struct net *net,

void nf_ct_iterate_cleanup_net(struct net *net,

			       int (*iter)(struct nf_conn *i, void *data),

			       void *data, u32 portid, int report);



/* also set unconfirmed conntracks as dying. Only use in module exit path. */

void nf_ct_iterate_destroy(int (*iter)(struct nf_conn *i, void *data),

			   void *data);



struct nf_conntrack_zone;



void nf_conntrack_free(struct nf_conn *ct);

include/net/netfilter/nf_conntrack_l3proto.h

+2 −2
Original line number Diff line number Diff line
@@ -71,7 +71,7 @@ struct nf_conntrack_l3proto { 
	struct module *me;

};



extern struct nf_conntrack_l3proto __rcu *nf_ct_l3protos[AF_MAX];

extern struct nf_conntrack_l3proto __rcu *nf_ct_l3protos[NFPROTO_NUMPROTO];



#ifdef CONFIG_SYSCTL

/* Protocol pernet registration. */
@@ -100,7 +100,7 @@ extern struct nf_conntrack_l3proto nf_conntrack_l3proto_generic; 
static inline struct nf_conntrack_l3proto *

__nf_ct_l3proto_find(u_int16_t l3proto)

{

	if (unlikely(l3proto >= AF_MAX))

	if (unlikely(l3proto >= NFPROTO_NUMPROTO))

		return &nf_conntrack_l3proto_generic;

	return rcu_dereference(nf_ct_l3protos[l3proto]);

}