History

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next

Pablo Neira Ayuso says: ==================== Netfilter/IPVS updates for net-next The following patchset contains Netfilter/IPVS updates for net-next, more specifically: * Updates for ipset: 1) Coding style fix for ipset comment extension, from Jeremy Sowden. 2) De-inline many functions in ipset, from Jeremy Sowden. 3) Move ipset function definition from header to source file. 4) Move ip_set_put_flags() to source, export it as a symbol, remove inline. 5) Move range_to_mask() to the source file where this is used. 6) Move ip_set_get_ip_port() to the source file where this is used. * IPVS selftests and netns improvements: 7) Two patches to speedup ipvs netns dismantle, from Haishuang Yan. 8) Three patches to add selftest script for ipvs, also from Haishuang Yan. * Conntrack updates and new nf_hook_slow_list() function: 9) Document ct ecache extension, from Florian Westphal. 10) Skip ct extensions from ctnetlink dump, from Florian. 11) Free ct extension immediately, from Florian. 12) Skip access to ecache extension from nf_ct_deliver_cached_events() this is not correct as reported by Syzbot. 13) Add and use nf_hook_slow_list(), from Florian. * Flowtable infrastructure updates: 14) Move priority to nf_flowtable definition. 15) Dynamic allocation of per-device hooks in flowtables. 16) Allow to include netdevice only once in flowtable definitions. 17) Rise maximum number of devices per flowtable. * Netfilter hardware offload infrastructure updates: 18) Add nft_flow_block_chain() helper function. 19) Pass callback list to nft_setup_cb_call(). 20) Add nft_flow_cls_offload_setup() helper function. 21) Remove rules for the unregistered device via netdevice event. 22) Support for multiple devices in a basechain definition at the ingress hook. 22) Add nft_chain_offload_cmd() helper function. 23) Add nft_flow_block_offload_init() helper function. 24) Rewind in case of failing to bind multiple devices to hook. 25) Typo in IPv6 tproxy module description, from Norman Rasmussen. ====================

David S. Miller committed 7 years ago

Commit 4b1f5dd2 parents 64fe8e9 671312e43 files · +1346 −730Browse files

Showing the changes to include/linux (4 of 43 files). Show all

Unified · Split

4 files
  1. include/linux/netfilter.h +31 −10
  2. include/linux/netfilter/ipset/ip_set.h +8 −188
  3. include/linux/netfilter/ipset/ip_set_bitmap.h +0 −14
  4. include/linux/netfilter/ipset/ip_set_getport.h +0 −3
include/linux/netfilter.h+31−10
@@ -199,6 +199,8 @@ extern struct static_key nf_hooks_needed[NFPROTO_NUMPROTO][NF_MAX_HOOKS]; · 198 unmodified lines
199199 int nf_hook_slow(struct sk_buff *skb, struct nf_hook_state *state,
200200 const struct nf_hook_entries *e, unsigned int i);
201201
202+void nf_hook_slow_list(struct list_head *head, struct nf_hook_state *state,
203+ const struct nf_hook_entries *e);
202204 /**
203205 * nf_hook - call a netfilter hook
204206 *
@@ -311,17 +313,36 @@ NF_HOOK_LIST(uint8_t pf, unsigned int hook, struct net *net, struct sock *sk, · 106 unmodified lines
311313 struct list_head *head, struct net_device *in, struct net_device *out,
312314 int (*okfn)(struct net *, struct sock *, struct sk_buff *))
313315 {
314− struct sk_buff *skb, *next;
315− struct list_head sublist;
316−
317− INIT_LIST_HEAD(&sublist);
318− list_for_each_entry_safe(skb, next, head, list) {
319− list_del(&skb->list);
320− if (nf_hook(pf, hook, net, sk, skb, in, out, okfn) == 1)
321− list_add_tail(&skb->list, &sublist);
316+ struct nf_hook_entries *hook_head = NULL;
317+
318+#ifdef CONFIG_JUMP_LABEL
319+ if (__builtin_constant_p(pf) &&
320+ __builtin_constant_p(hook) &&
321+ !static_key_false(&nf_hooks_needed[pf][hook]))
322+ return;
323+#endif
324+
325+ rcu_read_lock();
326+ switch (pf) {
327+ case NFPROTO_IPV4:
328+ hook_head = rcu_dereference(net->nf.hooks_ipv4[hook]);
329+ break;
330+ case NFPROTO_IPV6:
331+ hook_head = rcu_dereference(net->nf.hooks_ipv6[hook]);
332+ break;
333+ default:
334+ WARN_ON_ONCE(1);
335+ break;
322336 }
323− /* Put passed packets back on main list */
324− list_splice(&sublist, head);
337+
338+ if (hook_head) {
339+ struct nf_hook_state state;
340+
341+ nf_hook_state_init(&state, hook, pf, in, out, sk, net, okfn);
342+
343+ nf_hook_slow_list(head, &state, hook_head);
344+ }
345+ rcu_read_unlock();
325346 }
326347
327348 /* Call setsockopt() */
include/linux/netfilter/ipset/ip_set.h+8−188
@@ -269,34 +269,15 @@ ip_set_ext_destroy(struct ip_set *set, void *data) · 268 unmodified lines
269269 /* Check that the extension is enabled for the set and
270270 * call it's destroy function for its extension part in data.
271271 */
272− if (SET_WITH_COMMENT(set))
273− ip_set_extensions[IPSET_EXT_ID_COMMENT].destroy(
274− set, ext_comment(data, set));
275−}
272+ if (SET_WITH_COMMENT(set)) {
273+ struct ip_set_comment *c = ext_comment(data, set);
276274
277−static inline int
278−ip_set_put_flags(struct sk_buff *skb, struct ip_set *set)
279−{
280− u32 cadt_flags = 0;
281−
282− if (SET_WITH_TIMEOUT(set))
283− if (unlikely(nla_put_net32(skb, IPSET_ATTR_TIMEOUT,
284− htonl(set->timeout))))
285− return -EMSGSIZE;
286− if (SET_WITH_COUNTER(set))
287− cadt_flags |= IPSET_FLAG_WITH_COUNTERS;
288− if (SET_WITH_COMMENT(set))
289− cadt_flags |= IPSET_FLAG_WITH_COMMENT;
290− if (SET_WITH_SKBINFO(set))
291− cadt_flags |= IPSET_FLAG_WITH_SKBINFO;
292− if (SET_WITH_FORCEADD(set))
293− cadt_flags |= IPSET_FLAG_WITH_FORCEADD;
294−
295− if (!cadt_flags)
296− return 0;
297− return nla_put_net32(skb, IPSET_ATTR_CADT_FLAGS, htonl(cadt_flags));
275+ ip_set_extensions[IPSET_EXT_ID_COMMENT].destroy(set, c);
276+ }
298277 }
299278
279+int ip_set_put_flags(struct sk_buff *skb, struct ip_set *set);
280+
300281 /* Netlink CB args */
301282 enum {
302283 IPSET_CB_NET = 0, /* net namespace */
@@ -506,144 +487,8 @@ ip_set_timeout_set(unsigned long *timeout, u32 value) · 203 unmodified lines
506487 *timeout = t;
507488 }
508489
509−static inline u32
510−ip_set_timeout_get(const unsigned long *timeout)
511−{
512− u32 t;
513−
514− if (*timeout == IPSET_ELEM_PERMANENT)
515− return 0;
516−
517− t = jiffies_to_msecs(*timeout - jiffies)/MSEC_PER_SEC;
518− /* Zero value in userspace means no timeout */
519− return t == 0 ? 1 : t;
520−}
521−
522−static inline char*
523−ip_set_comment_uget(struct nlattr *tb)
524−{
525− return nla_data(tb);
526−}
527−
528−/* Called from uadd only, protected by the set spinlock.
529− * The kadt functions don't use the comment extensions in any way.
530− */
531−static inline void
532−ip_set_init_comment(struct ip_set *set, struct ip_set_comment *comment,
533− const struct ip_set_ext *ext)
534−{
535− struct ip_set_comment_rcu *c = rcu_dereference_protected(comment->c, 1);
536− size_t len = ext->comment ? strlen(ext->comment) : 0;
537−
538− if (unlikely(c)) {
539− set->ext_size -= sizeof(*c) + strlen(c->str) + 1;
540− kfree_rcu(c, rcu);
541− rcu_assign_pointer(comment->c, NULL);
542− }
543− if (!len)
544− return;
545− if (unlikely(len > IPSET_MAX_COMMENT_SIZE))
546− len = IPSET_MAX_COMMENT_SIZE;
547− c = kmalloc(sizeof(*c) + len + 1, GFP_ATOMIC);
548− if (unlikely(!c))
549− return;
550− strlcpy(c->str, ext->comment, len + 1);
551− set->ext_size += sizeof(*c) + strlen(c->str) + 1;
552− rcu_assign_pointer(comment->c, c);
553−}
554−
555−/* Used only when dumping a set, protected by rcu_read_lock() */
556−static inline int
557−ip_set_put_comment(struct sk_buff *skb, const struct ip_set_comment *comment)
558−{
559− struct ip_set_comment_rcu *c = rcu_dereference(comment->c);
560−
561− if (!c)
562− return 0;
563− return nla_put_string(skb, IPSET_ATTR_COMMENT, c->str);
564−}
565−
566−/* Called from uadd/udel, flush or the garbage collectors protected
567− * by the set spinlock.
568− * Called when the set is destroyed and when there can't be any user
569− * of the set data anymore.
570− */
571−static inline void
572−ip_set_comment_free(struct ip_set *set, struct ip_set_comment *comment)
573−{
574− struct ip_set_comment_rcu *c;
575−
576− c = rcu_dereference_protected(comment->c, 1);
577− if (unlikely(!c))
578− return;
579− set->ext_size -= sizeof(*c) + strlen(c->str) + 1;
580− kfree_rcu(c, rcu);
581− rcu_assign_pointer(comment->c, NULL);
582−}
583−
584−static inline void
585−ip_set_add_bytes(u64 bytes, struct ip_set_counter *counter)
586−{
587− atomic64_add((long long)bytes, &(counter)->bytes);
588−}
589−
590−static inline void
591−ip_set_add_packets(u64 packets, struct ip_set_counter *counter)
592−{
593− atomic64_add((long long)packets, &(counter)->packets);
594−}
595−
596−static inline u64
597−ip_set_get_bytes(const struct ip_set_counter *counter)
598−{
599− return (u64)atomic64_read(&(counter)->bytes);
600−}
601−
602−static inline u64
603−ip_set_get_packets(const struct ip_set_counter *counter)
604−{
605− return (u64)atomic64_read(&(counter)->packets);
606−}
607−
608−static inline bool
609−ip_set_match_counter(u64 counter, u64 match, u8 op)
610−{
611− switch (op) {
612− case IPSET_COUNTER_NONE:
613− return true;
614− case IPSET_COUNTER_EQ:
615− return counter == match;
616− case IPSET_COUNTER_NE:
617− return counter != match;
618− case IPSET_COUNTER_LT:
619− return counter < match;
620− case IPSET_COUNTER_GT:
621− return counter > match;
622− }
623− return false;
624−}
625−
626−static inline void
627−ip_set_update_counter(struct ip_set_counter *counter,
628− const struct ip_set_ext *ext, u32 flags)
629−{
630− if (ext->packets != ULLONG_MAX &&
631− !(flags & IPSET_FLAG_SKIP_COUNTER_UPDATE)) {
632− ip_set_add_bytes(ext->bytes, counter);
633− ip_set_add_packets(ext->packets, counter);
634− }
635−}
636−
637−static inline bool
638−ip_set_put_counter(struct sk_buff *skb, const struct ip_set_counter *counter)
639−{
640− return nla_put_net64(skb, IPSET_ATTR_BYTES,
641− cpu_to_be64(ip_set_get_bytes(counter)),
642− IPSET_ATTR_PAD) ||
643− nla_put_net64(skb, IPSET_ATTR_PACKETS,
644− cpu_to_be64(ip_set_get_packets(counter)),
645− IPSET_ATTR_PAD);
646−}
490+void ip_set_init_comment(struct ip_set *set, struct ip_set_comment *comment,
491+ const struct ip_set_ext *ext);
647492
648493 static inline void
649494 ip_set_init_counter(struct ip_set_counter *counter,
@@ -655,31 +500,6 @@ ip_set_init_counter(struct ip_set_counter *counter, · 5 unmodified lines
655500 atomic64_set(&(counter)->packets, (long long)(ext->packets));
656501 }
657502
658−static inline void
659−ip_set_get_skbinfo(struct ip_set_skbinfo *skbinfo,
660− const struct ip_set_ext *ext,
661− struct ip_set_ext *mext, u32 flags)
662−{
663− mext->skbinfo = *skbinfo;
664−}
665−
666−static inline bool
667−ip_set_put_skbinfo(struct sk_buff *skb, const struct ip_set_skbinfo *skbinfo)
668−{
669− /* Send nonzero parameters only */
670− return ((skbinfo->skbmark || skbinfo->skbmarkmask) &&
671− nla_put_net64(skb, IPSET_ATTR_SKBMARK,
672− cpu_to_be64((u64)skbinfo->skbmark << 32 |
673− skbinfo->skbmarkmask),
674− IPSET_ATTR_PAD)) ||
675− (skbinfo->skbprio &&
676− nla_put_net32(skb, IPSET_ATTR_SKBPRIO,
677− cpu_to_be32(skbinfo->skbprio))) ||
678− (skbinfo->skbqueue &&
679− nla_put_net16(skb, IPSET_ATTR_SKBQUEUE,
680− cpu_to_be16(skbinfo->skbqueue)));
681−}
682−
683503 static inline void
684504 ip_set_init_skbinfo(struct ip_set_skbinfo *skbinfo,
685505 const struct ip_set_ext *ext)
include/linux/netfilter/ipset/ip_set_bitmap.h+0−14
@@ -12,18 +12,4 @@ enum { · 11 unmodified lines
1212 IPSET_ADD_START_STORED_TIMEOUT,
1313 };
1414
15−/* Common functions */
16−
17−static inline u32
18−range_to_mask(u32 from, u32 to, u8 *bits)
19−{
20− u32 mask = 0xFFFFFFFE;
21−
22− *bits = 32;
23− while (--(*bits) > 0 && mask && (to & mask) != from)
24− mask <<= 1;
25−
26− return mask;
27−}
28−
2915 #endif /* __IP_SET_BITMAP_H */
include/linux/netfilter/ipset/ip_set_getport.h+0−3
@@ -20,9 +20,6 @@ static inline bool ip_set_get_ip6_port(const struct sk_buff *skb, bool src, · 19 unmodified lines
2020 }
2121 #endif
2222
23−extern bool ip_set_get_ip_port(const struct sk_buff *skb, u8 pf, bool src,
24− __be16 *port);
25−
2623 static inline bool ip_set_proto_with_ports(u8 proto)
2724 {
2825 switch (proto) {

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t