Commit 41e95736 authored by David S. Miller's avatar David S. Miller
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next 



Pablo Neira Ayuso says:

====================
Netfilter/IPVS updates for net-next

The following patchset contains Netfilter/IPVS updates for your
net-next tree. A couple of new features for nf_tables, and unsorted
cleanups and incremental updates for the Netfilter tree. More
specifically, they are:

1) Allow to check for TCP option presence via nft_exthdr, patch
   from Phil Sutter.

2) Add symmetric hash support to nft_hash, from Laura Garcia Liebana.

3) Use pr_cont() in ebt_log, from Joe Perches.

4) Remove some dead code in arp_tables reported via static analysis
   tool, from Colin Ian King.

5) Consolidate nf_tables expression validation, from Liping Zhang.

6) Consolidate set lookup via nft_set_lookup().

7) Remove unnecessary rcu read lock side in bridge netfilter, from
   Florian Westphal.

8) Remove unused variable in nf_reject_ipv4, from Tahee Yoo.

9) Pass nft_ctx struct to object initialization indirections, from
   Florian Westphal.

10) Add code to integrate conntrack helper into nf_tables, also from
    Florian.

11) Allow to check if interface index or name exists via
    NFTA_FIB_F_PRESENT, from Phil Sutter.

12) Simplify resolve_normal_ct(), from Florian.

13) Use per-limit spinlock in nft_limit and xt_limit, from Liping Zhang.

14) Use rwlock in nft_set_rbtree set, also from Liping Zhang.

15) One patch to remove a useless printk at netns init path in ipvs,
    and several patches to document IPVS knobs.

16) Use refcount_t for reference counter in the Netfilter/IPVS code,
    from Elena Reshetova.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents b9974d76 4485a841

Documentation/networking/ipvs-sysctl.txt

+60 −8
Original line number Diff line number Diff line
@@ -175,6 +175,14 @@ nat_icmp_send - BOOLEAN 
        for VS/NAT when the load balancer receives packets from real

        servers but the connection entries don't exist.



pmtu_disc - BOOLEAN

	0 - disabled

	not 0 - enabled (default)



	By default, reject with FRAG_NEEDED all DF packets that exceed

	the PMTU, irrespective of the forwarding method. For TUN method

	the flag can be disabled to fragment such packets.



secure_tcp - INTEGER

        0  - disabled (default)
@@ -185,15 +193,59 @@ secure_tcp - INTEGER 
        The value definition is the same as that of drop_entry and

        drop_packet.



sync_threshold - INTEGER

        default 3

sync_threshold - vector of 2 INTEGERs: sync_threshold, sync_period

	default 3 50



	It sets synchronization threshold, which is the minimum number

	of incoming packets that a connection needs to receive before

	the connection will be synchronized. A connection will be

	synchronized, every time the number of its incoming packets

        modulus 50 equals the threshold. The range of the threshold is

        from 0 to 49.

	modulus sync_period equals the threshold. The range of the

	threshold is from 0 to sync_period.



	When sync_period and sync_refresh_period are 0, send sync only

	for state changes or only once when pkts matches sync_threshold



sync_refresh_period - UNSIGNED INTEGER

	default 0



	In seconds, difference in reported connection timer that triggers

	new sync message. It can be used to avoid sync messages for the

	specified period (or half of the connection timeout if it is lower)

	if connection state is not changed since last sync.



	This is useful for normal connections with high traffic to reduce

	sync rate. Additionally, retry sync_retries times with period of

	sync_refresh_period/8.



sync_retries - INTEGER

	default 0



	Defines sync retries with period of sync_refresh_period/8. Useful

	to protect against loss of sync messages. The range of the

	sync_retries is from 0 to 3.



sync_qlen_max - UNSIGNED LONG



	Hard limit for queued sync messages that are not sent yet. It

	defaults to 1/32 of the memory pages but actually represents

	number of messages. It will protect us from allocating large

	parts of memory when the sending rate is lower than the queuing

	rate.



sync_sock_size - INTEGER

	default 0



	Configuration of SNDBUF (master) or RCVBUF (slave) socket limit.

	Default value is 0 (preserve system defaults).



sync_ports - INTEGER

	default 1



	The number of threads that master and backup servers can use for

	sync traffic. Every thread will use single UDP port, thread 0 will

	use the default port 8848 while last thread will use port

	8848+sync_ports-1.



snat_reroute - BOOLEAN

	0 - disabled

include/net/ip_vs.h

+9 −7
Original line number Diff line number Diff line
@@ -12,6 +12,8 @@ 
#include <linux/list.h>                 /* for struct list_head */

#include <linux/spinlock.h>             /* for struct rwlock_t */

#include <linux/atomic.h>               /* for struct atomic_t */

#include <linux/refcount.h>             /* for struct refcount_t */



#include <linux/compiler.h>

#include <linux/timer.h>

#include <linux/bug.h>
@@ -525,7 +527,7 @@ struct ip_vs_conn { 
	struct netns_ipvs	*ipvs;



	/* counter and timer */

	atomic_t		refcnt;		/* reference count */

	refcount_t		refcnt;		/* reference count */

	struct timer_list	timer;		/* Expiration timer */

	volatile unsigned long	timeout;	/* timeout */
@@ -667,7 +669,7 @@ struct ip_vs_dest { 
	atomic_t		conn_flags;	/* flags to copy to conn */

	atomic_t		weight;		/* server weight */



	atomic_t		refcnt;		/* reference counter */

	refcount_t		refcnt;		/* reference counter */

	struct ip_vs_stats      stats;          /* statistics */

	unsigned long		idle_start;	/* start time, jiffies */
@@ -1211,14 +1213,14 @@ struct ip_vs_conn * ip_vs_conn_out_get_proto(struct netns_ipvs *ipvs, int af, 
 */

static inline bool __ip_vs_conn_get(struct ip_vs_conn *cp)

{

	return atomic_inc_not_zero(&cp->refcnt);

	return refcount_inc_not_zero(&cp->refcnt);

}



/* put back the conn without restarting its timer */

static inline void __ip_vs_conn_put(struct ip_vs_conn *cp)

{

	smp_mb__before_atomic();

	atomic_dec(&cp->refcnt);

	refcount_dec(&cp->refcnt);

}

void ip_vs_conn_put(struct ip_vs_conn *cp);

void ip_vs_conn_fill_cport(struct ip_vs_conn *cp, __be16 cport);
@@ -1410,18 +1412,18 @@ void ip_vs_try_bind_dest(struct ip_vs_conn *cp); 


static inline void ip_vs_dest_hold(struct ip_vs_dest *dest)

{

	atomic_inc(&dest->refcnt);

	refcount_inc(&dest->refcnt);

}



static inline void ip_vs_dest_put(struct ip_vs_dest *dest)

{

	smp_mb__before_atomic();

	atomic_dec(&dest->refcnt);

	refcount_dec(&dest->refcnt);

}



static inline void ip_vs_dest_put_and_free(struct ip_vs_dest *dest)

{

	if (atomic_dec_and_test(&dest->refcnt))

	if (refcount_dec_and_test(&dest->refcnt))

		kfree(dest);

}

include/net/netfilter/nf_conntrack_expect.h

+3 −1
Original line number Diff line number Diff line
@@ -5,6 +5,8 @@ 
#ifndef _NF_CONNTRACK_EXPECT_H

#define _NF_CONNTRACK_EXPECT_H



#include <linux/refcount.h>



#include <net/netfilter/nf_conntrack.h>

#include <net/netfilter/nf_conntrack_zones.h>
@@ -37,7 +39,7 @@ struct nf_conntrack_expect { 
	struct timer_list timeout;



	/* Usage count. */

	atomic_t use;

	refcount_t use;



	/* Flags */

	unsigned int flags;

include/net/netfilter/nf_conntrack_timeout.h

+2 −1
Original line number Diff line number Diff line
@@ -4,6 +4,7 @@ 
#include <net/net_namespace.h>

#include <linux/netfilter/nf_conntrack_common.h>

#include <linux/netfilter/nf_conntrack_tuple_common.h>

#include <linux/refcount.h>

#include <net/netfilter/nf_conntrack.h>

#include <net/netfilter/nf_conntrack_extend.h>
@@ -12,7 +13,7 @@ 
struct ctnl_timeout {

	struct list_head	head;

	struct rcu_head		rcu_head;

	atomic_t		refcnt;

	refcount_t		refcnt;

	char			name[CTNL_TIMEOUT_NAME_MAX];

	__u16			l3num;

	struct nf_conntrack_l4proto *l4proto;

include/net/netfilter/nf_tables.h

+7 −5
Original line number Diff line number Diff line
@@ -385,10 +385,11 @@ static inline struct nft_set *nft_set_container_of(const void *priv) 
	return (void *)priv - offsetof(struct nft_set, data);

}



struct nft_set *nf_tables_set_lookup(const struct nft_table *table,

				     const struct nlattr *nla, u8 genmask);

struct nft_set *nf_tables_set_lookup_byid(const struct net *net,

					  const struct nlattr *nla, u8 genmask);

struct nft_set *nft_set_lookup(const struct net *net,

			       const struct nft_table *table,

			       const struct nlattr *nla_set_name,

			       const struct nlattr *nla_set_id,

			       u8 genmask);



static inline unsigned long nft_set_gc_interval(const struct nft_set *set)

{
@@ -1016,7 +1017,8 @@ struct nft_object_type { 
	unsigned int			maxattr;

	struct module			*owner;

	const struct nla_policy		*policy;

	int				(*init)(const struct nlattr * const tb[],

	int				(*init)(const struct nft_ctx *ctx,

						const struct nlattr *const tb[],

						struct nft_object *obj);

	void				(*destroy)(struct nft_object *obj);

	int				(*dump)(struct sk_buff *skb,

CRA Git | Maintained and supported by SUSTech CRA and CCSE