Commit 7bca5021 authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next 

Pablo Neira Ayuso says:

====================
Netfilter/IPVS updates for net-next

1) Missing dependencies in NFT_BRIDGE_REJECT, from Randy Dunlap.

2) Use atomic_inc_return() instead of atomic_add_return() in IPVS,
   from Yejune Deng.

3) Simplify check for overquota in xt_nfacct, from Kaixu Xia.

4) Move nfnl_acct_list away from struct net, from Miao Wang.

5) Pass actual sk in reject actions, from Jan Engelhardt.

6) Add timeout and protoinfo to ctnetlink destroy events,
   from Florian Westphal.

7) Four patches to generalize set infrastructure to support
   for multiple expressions per set element.

* git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next:
  netfilter: nftables: netlink support for several set element expressions
  netfilter: nftables: generalize set extension to support for several expressions
  netfilter: nftables: move nft_expr before nft_set
  netfilter: nftables: generalize set expressions support
  netfilter: ctnetlink: add timeout and protoinfo to destroy events
  netfilter: use actual socket sk for REJECT action
  netfilter: nfnl_acct: remove data from struct net
  netfilter: Remove unnecessary conversion to bool
  ipvs: replace atomic_add_return()
  netfilter: nft_reject_bridge: fix build errors due to code movement
====================

Link: https://lore.kernel.org/r/20201212230513.3465-1-pablo@netfilter.org


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents a6b5e026 48b0ae04

include/net/net_namespace.h

+0 −3
Original line number Diff line number Diff line
@@ -151,9 +151,6 @@ struct net { 
#endif

	struct sock		*nfnl;

	struct sock		*nfnl_stash;

#if IS_ENABLED(CONFIG_NETFILTER_NETLINK_ACCT)

	struct list_head        nfnl_acct_list;

#endif

#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)

	struct list_head	nfct_timeout_list;

#endif

include/net/netfilter/ipv4/nf_reject.h

+2 −2
Original line number Diff line number Diff line
@@ -8,8 +8,8 @@ 
#include <net/netfilter/nf_reject.h>



void nf_send_unreach(struct sk_buff *skb_in, int code, int hook);

void nf_send_reset(struct net *net, struct sk_buff *oldskb, int hook);



void nf_send_reset(struct net *net, struct sock *, struct sk_buff *oldskb,

		   int hook);

const struct tcphdr *nf_reject_ip_tcphdr_get(struct sk_buff *oldskb,

					     struct tcphdr *_oth, int hook);

struct iphdr *nf_reject_iphdr_put(struct sk_buff *nskb,

include/net/netfilter/ipv6/nf_reject.h

+2 −3
Original line number Diff line number Diff line
@@ -7,9 +7,8 @@ 


void nf_send_unreach6(struct net *net, struct sk_buff *skb_in, unsigned char code,

		      unsigned int hooknum);



void nf_send_reset6(struct net *net, struct sk_buff *oldskb, int hook);



void nf_send_reset6(struct net *net, struct sock *sk, struct sk_buff *oldskb,

		    int hook);

const struct tcphdr *nf_reject_ip6_tcphdr_get(struct sk_buff *oldskb,

					      struct tcphdr *otcph,

					      unsigned int *otcplen, int hook);

include/net/netfilter/nf_conntrack_l4proto.h

+1 −1
Original line number Diff line number Diff line
@@ -32,7 +32,7 @@ struct nf_conntrack_l4proto { 


	/* convert protoinfo to nfnetink attributes */

	int (*to_nlattr)(struct sk_buff *skb, struct nlattr *nla,

			 struct nf_conn *ct);

			 struct nf_conn *ct, bool destroy);



	/* convert nfnetlink attributes to protoinfo */

	int (*from_nlattr)(struct nlattr *tb[], struct nf_conn *ct);

include/net/netfilter/nf_tables.h

+58 −37
Original line number Diff line number Diff line
@@ -305,8 +305,33 @@ struct nft_set_estimate { 
	enum nft_set_class	space;

};



#define NFT_EXPR_MAXATTR		16

#define NFT_EXPR_SIZE(size)		(sizeof(struct nft_expr) + \

					 ALIGN(size, __alignof__(struct nft_expr)))



/**

 *	struct nft_expr - nf_tables expression

 *

 *	@ops: expression ops

 *	@data: expression private data

 */

struct nft_expr {

	const struct nft_expr_ops	*ops;

	unsigned char			data[]

		__attribute__((aligned(__alignof__(u64))));

};



static inline void *nft_expr_priv(const struct nft_expr *expr)

{

	return (void *)expr->data;

}



int nft_expr_clone(struct nft_expr *dst, struct nft_expr *src);

void nft_expr_destroy(const struct nft_ctx *ctx, struct nft_expr *expr);

int nft_expr_dump(struct sk_buff *skb, unsigned int attr,

		  const struct nft_expr *expr);



struct nft_set_ext;

struct nft_expr;



/**

 *	struct nft_set_ops - nf_tables set operations
@@ -396,6 +421,22 @@ struct nft_set_type { 
};

#define to_set_type(o) container_of(o, struct nft_set_type, ops)



struct nft_set_elem_expr {

	u8				size;

	unsigned char			data[]

		__attribute__((aligned(__alignof__(struct nft_expr))));

};



#define nft_setelem_expr_at(__elem_expr, __offset)			\

	((struct nft_expr *)&__elem_expr->data[__offset])



#define nft_setelem_expr_foreach(__expr, __elem_expr, __size)		\

	for (__expr = nft_setelem_expr_at(__elem_expr, 0), __size = 0;	\

	     __size < (__elem_expr)->size;				\

	     __size += (__expr)->ops->size, __expr = ((void *)(__expr)) + (__expr)->ops->size)



#define NFT_SET_EXPR_MAX	2



/**

 * 	struct nft_set - nf_tables set instance

 *
@@ -448,13 +489,14 @@ struct nft_set { 
	u16				policy;

	u16				udlen;

	unsigned char			*udata;

	struct nft_expr			*expr;

	/* runtime data below here */

	const struct nft_set_ops	*ops ____cacheline_aligned;

	u16				flags:14,

					genmask:2;

	u8				klen;

	u8				dlen;

	u8				num_exprs;

	struct nft_expr			*exprs[NFT_SET_EXPR_MAX];

	unsigned char			data[]

		__attribute__((aligned(__alignof__(u64))));

};
@@ -519,7 +561,7 @@ void nf_tables_destroy_set(const struct nft_ctx *ctx, struct nft_set *set); 
 *	@NFT_SET_EXT_TIMEOUT: element timeout

 *	@NFT_SET_EXT_EXPIRATION: element expiration time

 *	@NFT_SET_EXT_USERDATA: user data associated with the element

 *	@NFT_SET_EXT_EXPR: expression assiociated with the element

 *	@NFT_SET_EXT_EXPRESSIONS: expressions assiciated with the element

 *	@NFT_SET_EXT_OBJREF: stateful object reference associated with element

 *	@NFT_SET_EXT_NUM: number of extension types

 */
@@ -531,7 +573,7 @@ enum nft_set_extensions { 
	NFT_SET_EXT_TIMEOUT,

	NFT_SET_EXT_EXPIRATION,

	NFT_SET_EXT_USERDATA,

	NFT_SET_EXT_EXPR,

	NFT_SET_EXT_EXPRESSIONS,

	NFT_SET_EXT_OBJREF,

	NFT_SET_EXT_NUM

};
@@ -649,9 +691,9 @@ static inline struct nft_userdata *nft_set_ext_userdata(const struct nft_set_ext 
	return nft_set_ext(ext, NFT_SET_EXT_USERDATA);

}



static inline struct nft_expr *nft_set_ext_expr(const struct nft_set_ext *ext)

static inline struct nft_set_elem_expr *nft_set_ext_expr(const struct nft_set_ext *ext)

{

	return nft_set_ext(ext, NFT_SET_EXT_EXPR);

	return nft_set_ext(ext, NFT_SET_EXT_EXPRESSIONS);

}



static inline bool nft_set_elem_expired(const struct nft_set_ext *ext)
@@ -794,7 +836,6 @@ struct nft_offload_ctx; 
 *	@validate: validate expression, called during loop detection

 *	@data: extra data to attach to this expression operation

 */

struct nft_expr;

struct nft_expr_ops {

	void				(*eval)(const struct nft_expr *expr,

						struct nft_regs *regs,
@@ -830,32 +871,6 @@ struct nft_expr_ops { 
	void				*data;

};



#define NFT_EXPR_MAXATTR		16

#define NFT_EXPR_SIZE(size)		(sizeof(struct nft_expr) + \

					 ALIGN(size, __alignof__(struct nft_expr)))



/**

 *	struct nft_expr - nf_tables expression

 *

 *	@ops: expression ops

 *	@data: expression private data

 */

struct nft_expr {

	const struct nft_expr_ops	*ops;

	unsigned char			data[]

		__attribute__((aligned(__alignof__(u64))));

};



static inline void *nft_expr_priv(const struct nft_expr *expr)

{

	return (void *)expr->data;

}



int nft_expr_clone(struct nft_expr *dst, struct nft_expr *src);

void nft_expr_destroy(const struct nft_ctx *ctx, struct nft_expr *expr);

int nft_expr_dump(struct sk_buff *skb, unsigned int attr,

		  const struct nft_expr *expr);



/**

 *	struct nft_rule - nf_tables rule

 *
@@ -908,11 +923,17 @@ static inline void nft_set_elem_update_expr(const struct nft_set_ext *ext, 
					    struct nft_regs *regs,

					    const struct nft_pktinfo *pkt)

{

	struct nft_set_elem_expr *elem_expr;

	struct nft_expr *expr;

	u32 size;



	if (__nft_set_ext_exists(ext, NFT_SET_EXT_EXPR)) {

		expr = nft_set_ext_expr(ext);

	if (__nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS)) {

		elem_expr = nft_set_ext_expr(ext);

		nft_setelem_expr_foreach(expr, elem_expr, size) {

			expr->ops->eval(expr, regs, pkt);

			if (regs->verdict.code == NFT_BREAK)

				return;

		}

	}

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE