Skip to content

Commit c3e5336

Browse files
davem330davem330
committed
Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next
Pablo Neira Ayuso says: ==================== Netfilter updates for net-next The following patchset contains Netfilter updates for net-next: 1) Support for destination MAC in ipset, from Stefano Brivio. 2) Disallow all-zeroes MAC address in ipset, also from Stefano. 3) Add IPSET_CMD_GET_BYNAME and IPSET_CMD_GET_BYINDEX commands, introduce protocol version number 7, from Jozsef Kadlecsik. A follow up patch to fix ip_set_byindex() is also included in this batch. 4) Honor CTA_MARK_MASK from ctnetlink, from Andreas Jaggi. 5) Statify nf_flow_table_iterate(), from Taehee Yoo. 6) Use nf_flow_table_iterate() to simplify garbage collection in nf_flow_table logic, also from Taehee Yoo. 7) Don't use _bh variants of call_rcu(), rcu_barrier() and synchronize_rcu_bh() in Netfilter, from Paul E. McKenney. 8) Remove NFC_* cache definition from the old caching infrastructure. 9) Remove layer 4 port rover in NAT helpers, use random port instead, from Florian Westphal. 10) Use strscpy() in ipset, from Qian Cai. 11) Remove NF_NAT_RANGE_PROTO_RANDOM_FULLY branch now that random port is allocated by default, from Xiaozhou Liu. 12) Ignore NF_NAT_RANGE_PROTO_RANDOM too, from Florian Westphal. 13) Limit port allocation selection routine in NAT to avoid softlockup splats when most ports are in use, from Florian. 14) Remove unused parameters in nf_ct_l4proto_unregister_sysctl() from Yafang Shao. 15) Direct call to nf_nat_l4proto_unique_tuple() instead of indirection, from Florian Westphal. 16) Several patches to remove all layer 4 NAT indirections, remove nf_nat_l4proto struct, from Florian Westphal. 17) Fix RTP/RTCP source port translation when SNAT is in place, from Alin Nastac. 18) Selective rule dump per chain, from Phil Sutter. 19) Revisit CLUSTERIP target, this includes a deadlock fix from netns path, sleep in atomic, remove bogus WARN_ON_ONCE() and disallow mismatching IP address and MAC address. Patchset from Taehee Yoo. 20) Update UDP timeout to stream after 2 seconds, from Florian. 21) Shrink UDP established timeout to 120 seconds like TCP timewait. 22) Sysctl knobs to set GRE timeouts, from Yafang Shao. 23) Move seq_print_acct() to conntrack core file, from Florian. 24) Add enum for conntrack sysctl knobs, also from Florian. 25) Place nf_conntrack_acct, nf_conntrack_helper, nf_conntrack_events and nf_conntrack_timestamp knobs in the core, from Florian Westphal. As a side effect, shrink netns_ct structure by removing obsolete sysctl anchors, also from Florian. ==================== Signed-off-by: David S. Miller <[email protected]>
2 parents 339bbff + 8527f9d commit c3e5336

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

57 files changed

+1166
-1852
lines changed

‎Documentation/networking/nf_conntrack-sysctl.txt

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -157,7 +157,16 @@ nf_conntrack_udp_timeout - INTEGER (seconds)
157157
default 30
158158

159159
nf_conntrack_udp_timeout_stream - INTEGER (seconds)
160-
default 180
160+
default 120
161161

162162
This extended timeout will be used in case there is an UDP stream
163163
detected.
164+
165+
nf_conntrack_gre_timeout - INTEGER (seconds)
166+
default 30
167+
168+
nf_conntrack_gre_timeout_stream - INTEGER (seconds)
169+
default 180
170+
171+
This extended timeout will be used in case there is an GRE stream
172+
detected.

‎include/linux/netfilter/ipset/ip_set.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -303,11 +303,11 @@ ip_set_put_flags(struct sk_buff *skb, struct ip_set *set)
303303
/* Netlink CB args */
304304
enum {
305305
IPSET_CB_NET = 0, /* net namespace */
306+
IPSET_CB_PROTO, /* ipset protocol */
306307
IPSET_CB_DUMP, /* dump single set/all sets */
307308
IPSET_CB_INDEX, /* set index */
308309
IPSET_CB_PRIVATE, /* set private data */
309310
IPSET_CB_ARG0, /* type specific */
310-
IPSET_CB_ARG1,
311311
};
312312

313313
/* register and unregister set references */

‎include/linux/netfilter/nf_conntrack_proto_gre.h

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,5 @@ int nf_ct_gre_keymap_add(struct nf_conn *ct, enum ip_conntrack_dir dir,
4141
/* delete keymap entries */
4242
void nf_ct_gre_keymap_destroy(struct nf_conn *ct);
4343

44-
void nf_nat_need_gre(void);
45-
4644
#endif /* __KERNEL__ */
4745
#endif /* _CONNTRACK_PROTO_GRE_H */

‎include/net/netfilter/nf_conntrack.h

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,12 +27,17 @@
2727

2828
#include <net/netfilter/nf_conntrack_tuple.h>
2929

30+
struct nf_ct_udp {
31+
unsigned long stream_ts;
32+
};
33+
3034
/* per conntrack: protocol private data */
3135
union nf_conntrack_proto {
3236
/* insert conntrack proto private data here */
3337
struct nf_ct_dccp dccp;
3438
struct ip_ct_sctp sctp;
3539
struct ip_ct_tcp tcp;
40+
struct nf_ct_udp udp;
3641
struct nf_ct_gre gre;
3742
unsigned int tmpl_padto;
3843
};

‎include/net/netfilter/nf_conntrack_acct.h

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -46,9 +46,6 @@ struct nf_conn_acct *nf_ct_acct_ext_add(struct nf_conn *ct, gfp_t gfp)
4646
return acct;
4747
};
4848

49-
unsigned int seq_print_acct(struct seq_file *s, const struct nf_conn *ct,
50-
int dir);
51-
5249
/* Check if connection tracking accounting is enabled */
5350
static inline bool nf_ct_acct_enabled(struct net *net)
5451
{
@@ -61,8 +58,7 @@ static inline void nf_ct_set_acct(struct net *net, bool enable)
6158
net->ct.sysctl_acct = enable;
6259
}
6360

64-
int nf_conntrack_acct_pernet_init(struct net *net);
65-
void nf_conntrack_acct_pernet_fini(struct net *net);
61+
void nf_conntrack_acct_pernet_init(struct net *net);
6662

6763
int nf_conntrack_acct_init(void);
6864
void nf_conntrack_acct_fini(void);

‎include/net/netfilter/nf_conntrack_ecache.h

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -142,7 +142,7 @@ void nf_ct_expect_event_report(enum ip_conntrack_expect_events event,
142142
struct nf_conntrack_expect *exp,
143143
u32 portid, int report);
144144

145-
int nf_conntrack_ecache_pernet_init(struct net *net);
145+
void nf_conntrack_ecache_pernet_init(struct net *net);
146146
void nf_conntrack_ecache_pernet_fini(struct net *net);
147147

148148
int nf_conntrack_ecache_init(void);
@@ -182,10 +182,7 @@ static inline void nf_ct_expect_event_report(enum ip_conntrack_expect_events e,
182182
u32 portid,
183183
int report) {}
184184

185-
static inline int nf_conntrack_ecache_pernet_init(struct net *net)
186-
{
187-
return 0;
188-
}
185+
static inline void nf_conntrack_ecache_pernet_init(struct net *net) {}
189186

190187
static inline void nf_conntrack_ecache_pernet_fini(struct net *net)
191188
{

‎include/net/netfilter/nf_conntrack_helper.h

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -124,8 +124,7 @@ static inline void *nfct_help_data(const struct nf_conn *ct)
124124
return (void *)help->data;
125125
}
126126

127-
int nf_conntrack_helper_pernet_init(struct net *net);
128-
void nf_conntrack_helper_pernet_fini(struct net *net);
127+
void nf_conntrack_helper_pernet_init(struct net *net);
129128

130129
int nf_conntrack_helper_init(void);
131130
void nf_conntrack_helper_fini(void);

‎include/net/netfilter/nf_conntrack_timestamp.h

Lines changed: 2 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -49,21 +49,12 @@ static inline void nf_ct_set_tstamp(struct net *net, bool enable)
4949
}
5050

5151
#ifdef CONFIG_NF_CONNTRACK_TIMESTAMP
52-
int nf_conntrack_tstamp_pernet_init(struct net *net);
53-
void nf_conntrack_tstamp_pernet_fini(struct net *net);
52+
void nf_conntrack_tstamp_pernet_init(struct net *net);
5453

5554
int nf_conntrack_tstamp_init(void);
5655
void nf_conntrack_tstamp_fini(void);
5756
#else
58-
static inline int nf_conntrack_tstamp_pernet_init(struct net *net)
59-
{
60-
return 0;
61-
}
62-
63-
static inline void nf_conntrack_tstamp_pernet_fini(struct net *net)
64-
{
65-
return;
66-
}
57+
static inline void nf_conntrack_tstamp_pernet_init(struct net *net) {}
6758

6859
static inline int nf_conntrack_tstamp_init(void)
6960
{

‎include/net/netfilter/nf_flow_table.h

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -95,10 +95,6 @@ void flow_offload_free(struct flow_offload *flow);
9595
int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow);
9696
struct flow_offload_tuple_rhash *flow_offload_lookup(struct nf_flowtable *flow_table,
9797
struct flow_offload_tuple *tuple);
98-
int nf_flow_table_iterate(struct nf_flowtable *flow_table,
99-
void (*iter)(struct flow_offload *flow, void *data),
100-
void *data);
101-
10298
void nf_flow_table_cleanup(struct net_device *dev);
10399

104100
int nf_flow_table_init(struct nf_flowtable *flow_table);

‎include/net/netfilter/nf_nat_l3proto.h

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2,18 +2,11 @@
22
#ifndef _NF_NAT_L3PROTO_H
33
#define _NF_NAT_L3PROTO_H
44

5-
struct nf_nat_l4proto;
65
struct nf_nat_l3proto {
76
u8 l3proto;
87

9-
bool (*in_range)(const struct nf_conntrack_tuple *t,
10-
const struct nf_nat_range2 *range);
11-
12-
u32 (*secure_port)(const struct nf_conntrack_tuple *t, __be16);
13-
148
bool (*manip_pkt)(struct sk_buff *skb,
159
unsigned int iphdroff,
16-
const struct nf_nat_l4proto *l4proto,
1710
const struct nf_conntrack_tuple *target,
1811
enum nf_nat_manip_type maniptype);
1912

‎include/net/netfilter/nf_nat_l4proto.h

Lines changed: 6 additions & 72 deletions
Original file line numberDiff line numberDiff line change
@@ -5,78 +5,12 @@
55
#include <net/netfilter/nf_nat.h>
66
#include <linux/netfilter/nfnetlink_conntrack.h>
77

8-
struct nf_nat_range;
98
struct nf_nat_l3proto;
109

11-
struct nf_nat_l4proto {
12-
/* Protocol number. */
13-
u8 l4proto;
14-
15-
/* Translate a packet to the target according to manip type.
16-
* Return true if succeeded.
17-
*/
18-
bool (*manip_pkt)(struct sk_buff *skb,
19-
const struct nf_nat_l3proto *l3proto,
20-
unsigned int iphdroff, unsigned int hdroff,
21-
const struct nf_conntrack_tuple *tuple,
22-
enum nf_nat_manip_type maniptype);
23-
24-
/* Is the manipable part of the tuple between min and max incl? */
25-
bool (*in_range)(const struct nf_conntrack_tuple *tuple,
26-
enum nf_nat_manip_type maniptype,
27-
const union nf_conntrack_man_proto *min,
28-
const union nf_conntrack_man_proto *max);
29-
30-
/* Alter the per-proto part of the tuple (depending on
31-
* maniptype), to give a unique tuple in the given range if
32-
* possible. Per-protocol part of tuple is initialized to the
33-
* incoming packet.
34-
*/
35-
void (*unique_tuple)(const struct nf_nat_l3proto *l3proto,
36-
struct nf_conntrack_tuple *tuple,
37-
const struct nf_nat_range2 *range,
38-
enum nf_nat_manip_type maniptype,
39-
const struct nf_conn *ct);
40-
41-
int (*nlattr_to_range)(struct nlattr *tb[],
42-
struct nf_nat_range2 *range);
43-
};
44-
45-
/* Protocol registration. */
46-
int nf_nat_l4proto_register(u8 l3proto, const struct nf_nat_l4proto *l4proto);
47-
void nf_nat_l4proto_unregister(u8 l3proto,
48-
const struct nf_nat_l4proto *l4proto);
49-
50-
const struct nf_nat_l4proto *__nf_nat_l4proto_find(u8 l3proto, u8 l4proto);
51-
52-
/* Built-in protocols. */
53-
extern const struct nf_nat_l4proto nf_nat_l4proto_tcp;
54-
extern const struct nf_nat_l4proto nf_nat_l4proto_udp;
55-
extern const struct nf_nat_l4proto nf_nat_l4proto_icmp;
56-
extern const struct nf_nat_l4proto nf_nat_l4proto_icmpv6;
57-
extern const struct nf_nat_l4proto nf_nat_l4proto_unknown;
58-
#ifdef CONFIG_NF_NAT_PROTO_DCCP
59-
extern const struct nf_nat_l4proto nf_nat_l4proto_dccp;
60-
#endif
61-
#ifdef CONFIG_NF_NAT_PROTO_SCTP
62-
extern const struct nf_nat_l4proto nf_nat_l4proto_sctp;
63-
#endif
64-
#ifdef CONFIG_NF_NAT_PROTO_UDPLITE
65-
extern const struct nf_nat_l4proto nf_nat_l4proto_udplite;
66-
#endif
67-
68-
bool nf_nat_l4proto_in_range(const struct nf_conntrack_tuple *tuple,
69-
enum nf_nat_manip_type maniptype,
70-
const union nf_conntrack_man_proto *min,
71-
const union nf_conntrack_man_proto *max);
72-
73-
void nf_nat_l4proto_unique_tuple(const struct nf_nat_l3proto *l3proto,
74-
struct nf_conntrack_tuple *tuple,
75-
const struct nf_nat_range2 *range,
76-
enum nf_nat_manip_type maniptype,
77-
const struct nf_conn *ct, u16 *rover);
78-
79-
int nf_nat_l4proto_nlattr_to_range(struct nlattr *tb[],
80-
struct nf_nat_range2 *range);
81-
10+
/* Translate a packet to the target according to manip type. Return on success. */
11+
bool nf_nat_l4proto_manip_pkt(struct sk_buff *skb,
12+
const struct nf_nat_l3proto *l3proto,
13+
unsigned int iphdroff, unsigned int hdroff,
14+
const struct nf_conntrack_tuple *tuple,
15+
enum nf_nat_manip_type maniptype);
8216
#endif /*_NF_NAT_L4PROTO_H*/

‎include/net/netns/conntrack.h

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -97,18 +97,14 @@ struct netns_ct {
9797
struct delayed_work ecache_dwork;
9898
bool ecache_dwork_pending;
9999
#endif
100+
bool auto_assign_helper_warned;
100101
#ifdef CONFIG_SYSCTL
101102
struct ctl_table_header *sysctl_header;
102-
struct ctl_table_header *acct_sysctl_header;
103-
struct ctl_table_header *tstamp_sysctl_header;
104-
struct ctl_table_header *event_sysctl_header;
105-
struct ctl_table_header *helper_sysctl_header;
106103
#endif
107104
unsigned int sysctl_log_invalid; /* Log invalid packets */
108105
int sysctl_events;
109106
int sysctl_acct;
110107
int sysctl_auto_assign_helper;
111-
bool auto_assign_helper_warned;
112108
int sysctl_tstamp;
113109
int sysctl_checksum;
114110

‎include/uapi/linux/netfilter.h

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -34,10 +34,6 @@
3434

3535
/* only for userspace compatibility */
3636
#ifndef __KERNEL__
37-
/* Generic cache responses from hook functions.
38-
<= 0x2000 is used for protocol-flags. */
39-
#define NFC_UNKNOWN 0x4000
40-
#define NFC_ALTERED 0x8000
4137

4238
/* NF_VERDICT_BITS should be 8 now, but userspace might break if this changes */
4339
#define NF_VERDICT_BITS 16

‎include/uapi/linux/netfilter/ipset/ip_set.h

Lines changed: 12 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,9 @@
1313

1414
#include <linux/types.h>
1515

16-
/* The protocol version */
17-
#define IPSET_PROTOCOL 6
16+
/* The protocol versions */
17+
#define IPSET_PROTOCOL 7
18+
#define IPSET_PROTOCOL_MIN 6
1819

1920
/* The max length of strings including NUL: set and type identifiers */
2021
#define IPSET_MAXNAMELEN 32
@@ -38,17 +39,19 @@ enum ipset_cmd {
3839
IPSET_CMD_TEST, /* 11: Test an element in a set */
3940
IPSET_CMD_HEADER, /* 12: Get set header data only */
4041
IPSET_CMD_TYPE, /* 13: Get set type */
42+
IPSET_CMD_GET_BYNAME, /* 14: Get set index by name */
43+
IPSET_CMD_GET_BYINDEX, /* 15: Get set name by index */
4144
IPSET_MSG_MAX, /* Netlink message commands */
4245

4346
/* Commands in userspace: */
44-
IPSET_CMD_RESTORE = IPSET_MSG_MAX, /* 14: Enter restore mode */
45-
IPSET_CMD_HELP, /* 15: Get help */
46-
IPSET_CMD_VERSION, /* 16: Get program version */
47-
IPSET_CMD_QUIT, /* 17: Quit from interactive mode */
47+
IPSET_CMD_RESTORE = IPSET_MSG_MAX, /* 16: Enter restore mode */
48+
IPSET_CMD_HELP, /* 17: Get help */
49+
IPSET_CMD_VERSION, /* 18: Get program version */
50+
IPSET_CMD_QUIT, /* 19: Quit from interactive mode */
4851

4952
IPSET_CMD_MAX,
5053

51-
IPSET_CMD_COMMIT = IPSET_CMD_MAX, /* 18: Commit buffered commands */
54+
IPSET_CMD_COMMIT = IPSET_CMD_MAX, /* 20: Commit buffered commands */
5255
};
5356

5457
/* Attributes at command level */
@@ -66,6 +69,7 @@ enum {
6669
IPSET_ATTR_LINENO, /* 9: Restore lineno */
6770
IPSET_ATTR_PROTOCOL_MIN, /* 10: Minimal supported version number */
6871
IPSET_ATTR_REVISION_MIN = IPSET_ATTR_PROTOCOL_MIN, /* type rev min */
72+
IPSET_ATTR_INDEX, /* 11: Kernel index of set */
6973
__IPSET_ATTR_CMD_MAX,
7074
};
7175
#define IPSET_ATTR_CMD_MAX (__IPSET_ATTR_CMD_MAX - 1)
@@ -223,6 +227,7 @@ enum ipset_adt {
223227

224228
/* Sets are identified by an index in kernel space. Tweak with ip_set_id_t
225229
* and IPSET_INVALID_ID if you want to increase the max number of sets.
230+
* Also, IPSET_ATTR_INDEX must be changed.
226231
*/
227232
typedef __u16 ip_set_id_t;
228233

‎include/uapi/linux/netfilter_decnet.h

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -15,16 +15,6 @@
1515

1616
#include <limits.h> /* for INT_MIN, INT_MAX */
1717

18-
/* IP Cache bits. */
19-
/* Src IP address. */
20-
#define NFC_DN_SRC 0x0001
21-
/* Dest IP address. */
22-
#define NFC_DN_DST 0x0002
23-
/* Input device. */
24-
#define NFC_DN_IF_IN 0x0004
25-
/* Output device. */
26-
#define NFC_DN_IF_OUT 0x0008
27-
2818
/* kernel define is in netfilter_defs.h */
2919
#define NF_DN_NUMHOOKS 7
3020
#endif /* ! __KERNEL__ */

‎include/uapi/linux/netfilter_ipv4.h

Lines changed: 0 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -13,34 +13,6 @@
1313

1414
#include <limits.h> /* for INT_MIN, INT_MAX */
1515

16-
/* IP Cache bits. */
17-
/* Src IP address. */
18-
#define NFC_IP_SRC 0x0001
19-
/* Dest IP address. */
20-
#define NFC_IP_DST 0x0002
21-
/* Input device. */
22-
#define NFC_IP_IF_IN 0x0004
23-
/* Output device. */
24-
#define NFC_IP_IF_OUT 0x0008
25-
/* TOS. */
26-
#define NFC_IP_TOS 0x0010
27-
/* Protocol. */
28-
#define NFC_IP_PROTO 0x0020
29-
/* IP options. */
30-
#define NFC_IP_OPTIONS 0x0040
31-
/* Frag & flags. */
32-
#define NFC_IP_FRAG 0x0080
33-
34-
/* Per-protocol information: only matters if proto match. */
35-
/* TCP flags. */
36-
#define NFC_IP_TCPFLAGS 0x0100
37-
/* Source port. */
38-
#define NFC_IP_SRC_PT 0x0200
39-
/* Dest port. */
40-
#define NFC_IP_DST_PT 0x0400
41-
/* Something else about the proto */
42-
#define NFC_IP_PROTO_UNKNOWN 0x2000
43-
4416
/* IP Hooks */
4517
/* After promisc drops, checksum checks. */
4618
#define NF_IP_PRE_ROUTING 0

0 commit comments

Comments
 (0)