Commit 581a5f2a authored by David S. Miller's avatar David S. Miller
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next 



Pablo Neira Ayuso says:

====================
Netfilter updates for net-next

The following patchset contains Netfilter/IPVS updates for your net-next tree.
In sum, patches to address fallout from the previous round plus updates from
the IPVS folks via Simon Horman, they are:

1) Add a new scheduler to IPVS: The weighted overflow scheduling algorithm
   directs network connections to the server with the highest weight that is
   currently available and overflows to the next when active connections exceed
   the node's weight. From Raducu Deaconu.

2) Fix locking ordering in IPVS, always take rtnl_lock in first place. Patch
   from Julian Anastasov.

3) Allow to indicate the MTU to the IPVS in-kernel state sync daemon. From
   Julian Anastasov.

4) Enhance multicast configuration for the IPVS state sync daemon. Also from
   Julian.

5) Resolve sparse warnings in the nf_dup modules.

6) Fix a linking problem when CONFIG_NF_DUP_IPV6 is not set.

7) Add ICMP codes 5 and 6 to IPv6 REJECT target, they are more informative
   subsets of code 1. From Andreas Herz.

8) Revert the jumpstack size calculation from mark_source_chains due to chain
   depth miscalculations, from Florian Westphal.

9) Calm down more sparse warning around the Netfilter tree, again from Florian
   Westphal.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents cc7acad1 851345c5

include/net/ip_vs.h

+15 −8
Original line number Diff line number Diff line
@@ -846,6 +846,17 @@ struct ipvs_master_sync_state { 
/* How much time to keep dests in trash */

#define IP_VS_DEST_TRASH_PERIOD		(120 * HZ)



struct ipvs_sync_daemon_cfg {

	union nf_inet_addr	mcast_group;

	int			syncid;

	u16			sync_maxlen;

	u16			mcast_port;

	u8			mcast_af;

	u8			mcast_ttl;

	/* multicast interface name */

	char			mcast_ifn[IP_VS_IFNAME_MAXLEN];

};



/* IPVS in network namespace */

struct netns_ipvs {

	int			gen;		/* Generation */
@@ -961,15 +972,10 @@ struct netns_ipvs { 
	spinlock_t		sync_buff_lock;

	struct task_struct	**backup_threads;

	int			threads_mask;

	int			send_mesg_maxlen;

	int			recv_mesg_maxlen;

	volatile int		sync_state;

	volatile int		master_syncid;

	volatile int		backup_syncid;

	struct mutex		sync_mutex;

	/* multicast interface name */

	char			master_mcast_ifn[IP_VS_IFNAME_MAXLEN];

	char			backup_mcast_ifn[IP_VS_IFNAME_MAXLEN];

	struct ipvs_sync_daemon_cfg	mcfg;	/* Master Configuration */

	struct ipvs_sync_daemon_cfg	bcfg;	/* Backup Configuration */

	/* net name space ptr */

	struct net		*net;            /* Needed by timer routines */

	/* Number of heterogeneous destinations, needed becaus heterogeneous
@@ -1408,7 +1414,8 @@ static inline void ip_vs_dest_put_and_free(struct ip_vs_dest *dest) 
/* IPVS sync daemon data and function prototypes

 * (from ip_vs_sync.c)

 */

int start_sync_thread(struct net *net, int state, char *mcast_ifn, __u8 syncid);

int start_sync_thread(struct net *net, struct ipvs_sync_daemon_cfg *cfg,

		      int state);

int stop_sync_thread(struct net *net, int state);

void ip_vs_sync_conn(struct net *net, struct ip_vs_conn *cp, int pkts);

include/uapi/linux/ip_vs.h

+5 −0
Original line number Diff line number Diff line
@@ -406,6 +406,11 @@ enum { 
	IPVS_DAEMON_ATTR_STATE,		/* sync daemon state (master/backup) */

	IPVS_DAEMON_ATTR_MCAST_IFN,	/* multicast interface name */

	IPVS_DAEMON_ATTR_SYNC_ID,	/* SyncID we belong to */

	IPVS_DAEMON_ATTR_SYNC_MAXLEN,	/* UDP Payload Size */

	IPVS_DAEMON_ATTR_MCAST_GROUP,	/* IPv4 Multicast Address */

	IPVS_DAEMON_ATTR_MCAST_GROUP6,	/* IPv6 Multicast Address */

	IPVS_DAEMON_ATTR_MCAST_PORT,	/* Multicast Port (base) */

	IPVS_DAEMON_ATTR_MCAST_TTL,	/* Multicast TTL */

	__IPVS_DAEMON_ATTR_MAX,

};

include/uapi/linux/netfilter_ipv6/ip6t_REJECT.h

+3 −1
Original line number Diff line number Diff line
@@ -10,7 +10,9 @@ enum ip6t_reject_with { 
	IP6T_ICMP6_ADDR_UNREACH,

	IP6T_ICMP6_PORT_UNREACH,

	IP6T_ICMP6_ECHOREPLY,

	IP6T_TCP_RESET

	IP6T_TCP_RESET,

	IP6T_ICMP6_POLICY_FAIL,

	IP6T_ICMP6_REJECT_ROUTE

};



struct ip6t_reject_info {

net/bridge/netfilter/ebtables.c

+1 −1
Original line number Diff line number Diff line
@@ -176,7 +176,7 @@ ebt_basic_match(const struct ebt_entry *e, const struct sk_buff *skb, 
	return 0;

}



static inline __pure

static inline

struct ebt_entry *ebt_next_entry(const struct ebt_entry *entry)

{

	return (void *)entry + entry->next_offset;

net/ipv4/netfilter/arp_tables.c

+7 −12
Original line number Diff line number Diff line
@@ -367,13 +367,10 @@ static inline bool unconditional(const struct arpt_arp *arp) 


/* Figures out from what hook each rule can be called: returns 0 if

 * there are loops.  Puts hook bitmask in comefrom.

 *

 * Keeps track of largest call depth seen and stores it in newinfo->stacksize.

 */

static int mark_source_chains(struct xt_table_info *newinfo,

static int mark_source_chains(const struct xt_table_info *newinfo,

			      unsigned int valid_hooks, void *entry0)

{

	unsigned int calldepth, max_calldepth = 0;

	unsigned int hook;



	/* No recursion; use packet counter to save back ptrs (reset
@@ -389,7 +386,6 @@ static int mark_source_chains(struct xt_table_info *newinfo, 


		/* Set initial back pointer. */

		e->counters.pcnt = pos;

		calldepth = 0;



		for (;;) {

			const struct xt_standard_target *t
@@ -444,8 +440,6 @@ static int mark_source_chains(struct xt_table_info *newinfo, 
					(entry0 + pos + size);

				e->counters.pcnt = pos;

				pos += size;

				if (calldepth > 0)

					--calldepth;

			} else {

				int newpos = t->verdict;
@@ -460,10 +454,6 @@ static int mark_source_chains(struct xt_table_info *newinfo, 
						return 0;

					}



					if (entry0 + newpos != arpt_next_entry(e) &&

					    ++calldepth > max_calldepth)

						max_calldepth = calldepth;



					/* This a jump; chase it. */

					duprintf("Jump rule %u -> %u\n",

						 pos, newpos);
@@ -480,7 +470,6 @@ static int mark_source_chains(struct xt_table_info *newinfo, 
		next:

		duprintf("Finished chain %u\n", hook);

	}

	newinfo->stacksize = max_calldepth;

	return 1;

}
@@ -670,6 +659,9 @@ static int translate_table(struct xt_table_info *newinfo, void *entry0, 
		if (ret != 0)

			break;

		++i;

		if (strcmp(arpt_get_target(iter)->u.user.name,

		    XT_ERROR_TARGET) == 0)

			++newinfo->stacksize;

	}

	duprintf("translate_table: ARPT_ENTRY_ITERATE gives %d\n", ret);

	if (ret != 0)
@@ -1442,6 +1434,9 @@ static int translate_compat_table(const char *name, 
			break;

		}

		++i;

		if (strcmp(arpt_get_target(iter1)->u.user.name,

		    XT_ERROR_TARGET) == 0)

			++newinfo->stacksize;

	}

	if (ret) {

		/*

CRA Git | Maintained and supported by SUSTech CRA and CCSE