Commit 5fe8e519 authored by David S. Miller's avatar David S. Miller
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next 

Pablo Neira Ayuso says:

====================
Netfilter updates for net-next

The following patchset contains Netfilter updates for net-next:

1) Support for SCTP chunks matching on nf_tables, from Phil Sutter.

2) Skip LDMXCSR, we don't need a valid MXCSR state. From Stefano Brivio.

3) CONFIG_RETPOLINE for nf_tables set lookups, from Florian Westphal.

4) A few Kconfig leading spaces removal, from Juerg Haefliger.

5) Remove spinlock from xt_limit, from Jason Baron.

6) Remove useless initialization in xt_CT, oneliner from Yang Li.

7) Tree-wide replacement of netlink_unicast() by nfnetlink_unicast().

8) Reduce footprint of several structures: xt_action_param,
   nft_pktinfo and nf_hook_state, from Florian.

10) Add nft_thoff() and nft_sk() helpers and use them, also from Florian.

11) Fix documentation in nf_tables pipapo avx2, from Florian Westphal.

12) Fix clang-12 fmt string warnings, also from Florian.
====================
parents 92c35cfd 8a1c08ad

include/linux/netfilter.h

+2 −2
Original line number Diff line number Diff line
@@ -65,8 +65,8 @@ struct nf_hook_ops; 
struct sock;



struct nf_hook_state {

	unsigned int hook;

	u_int8_t pf;

	u8 hook;

	u8 pf;

	struct net_device *in;

	struct net_device *out;

	struct sock *sk;

include/linux/netfilter/x_tables.h

+1 −1
Original line number Diff line number Diff line
@@ -36,8 +36,8 @@ struct xt_action_param { 
		const void *matchinfo, *targinfo;

	};

	const struct nf_hook_state *state;

	int fragoff;

	unsigned int thoff;

	u16 fragoff;

	bool hotdrop;

};

include/net/netfilter/nf_tables.h

+22 −12
Original line number Diff line number Diff line
@@ -23,35 +23,46 @@ struct module; 


struct nft_pktinfo {

	struct sk_buff			*skb;

	const struct nf_hook_state	*state;

	bool				tprot_set;

	u8				tprot;

	/* for x_tables compatibility */

	struct xt_action_param		xt;

	u16				fragoff;

	unsigned int			thoff;

};



static inline struct sock *nft_sk(const struct nft_pktinfo *pkt)

{

	return pkt->state->sk;

}



static inline unsigned int nft_thoff(const struct nft_pktinfo *pkt)

{

	return pkt->thoff;

}



static inline struct net *nft_net(const struct nft_pktinfo *pkt)

{

	return pkt->xt.state->net;

	return pkt->state->net;

}



static inline unsigned int nft_hook(const struct nft_pktinfo *pkt)

{

	return pkt->xt.state->hook;

	return pkt->state->hook;

}



static inline u8 nft_pf(const struct nft_pktinfo *pkt)

{

	return pkt->xt.state->pf;

	return pkt->state->pf;

}



static inline const struct net_device *nft_in(const struct nft_pktinfo *pkt)

{

	return pkt->xt.state->in;

	return pkt->state->in;

}



static inline const struct net_device *nft_out(const struct nft_pktinfo *pkt)

{

	return pkt->xt.state->out;

	return pkt->state->out;

}



static inline void nft_set_pktinfo(struct nft_pktinfo *pkt,
@@ -59,16 +70,15 @@ static inline void nft_set_pktinfo(struct nft_pktinfo *pkt, 
				   const struct nf_hook_state *state)

{

	pkt->skb = skb;

	pkt->xt.state = state;

	pkt->state = state;

}



static inline void nft_set_pktinfo_unspec(struct nft_pktinfo *pkt,

					  struct sk_buff *skb)

static inline void nft_set_pktinfo_unspec(struct nft_pktinfo *pkt)

{

	pkt->tprot_set = false;

	pkt->tprot = 0;

	pkt->xt.thoff = 0;

	pkt->xt.fragoff = 0;

	pkt->thoff = 0;

	pkt->fragoff = 0;

}



/**

include/net/netfilter/nf_tables_core.h

+31 −0
Original line number Diff line number Diff line
@@ -3,6 +3,7 @@ 
#define _NET_NF_TABLES_CORE_H



#include <net/netfilter/nf_tables.h>

#include <linux/indirect_call_wrapper.h>



extern struct nft_expr_type nft_imm_type;

extern struct nft_expr_type nft_cmp_type;
@@ -88,6 +89,36 @@ extern const struct nft_set_type nft_set_bitmap_type; 
extern const struct nft_set_type nft_set_pipapo_type;

extern const struct nft_set_type nft_set_pipapo_avx2_type;



#ifdef CONFIG_RETPOLINE

bool nft_rhash_lookup(const struct net *net, const struct nft_set *set,

		      const u32 *key, const struct nft_set_ext **ext);

bool nft_rbtree_lookup(const struct net *net, const struct nft_set *set,

		       const u32 *key, const struct nft_set_ext **ext);

bool nft_bitmap_lookup(const struct net *net, const struct nft_set *set,

		       const u32 *key, const struct nft_set_ext **ext);

bool nft_hash_lookup_fast(const struct net *net,

			  const struct nft_set *set,

			  const u32 *key, const struct nft_set_ext **ext);

bool nft_hash_lookup(const struct net *net, const struct nft_set *set,

		     const u32 *key, const struct nft_set_ext **ext);

bool nft_set_do_lookup(const struct net *net, const struct nft_set *set,

		       const u32 *key, const struct nft_set_ext **ext);

#else

static inline bool

nft_set_do_lookup(const struct net *net, const struct nft_set *set,

		  const u32 *key, const struct nft_set_ext **ext)

{

	return set->ops->lookup(net, set, key, ext);

}

#endif



/* called from nft_pipapo_avx2.c */

bool nft_pipapo_lookup(const struct net *net, const struct nft_set *set,

		       const u32 *key, const struct nft_set_ext **ext);

/* called from nft_set_pipapo.c */

bool nft_pipapo_avx2_lookup(const struct net *net, const struct nft_set *set,

			    const u32 *key, const struct nft_set_ext **ext);



struct nft_expr;

struct nft_regs;

struct nft_pktinfo;

include/net/netfilter/nf_tables_ipv4.h

+18 −22
Original line number Diff line number Diff line
@@ -5,26 +5,24 @@ 
#include <net/netfilter/nf_tables.h>

#include <net/ip.h>



static inline void nft_set_pktinfo_ipv4(struct nft_pktinfo *pkt,

					struct sk_buff *skb)

static inline void nft_set_pktinfo_ipv4(struct nft_pktinfo *pkt)

{

	struct iphdr *ip;



	ip = ip_hdr(pkt->skb);

	pkt->tprot_set = true;

	pkt->tprot = ip->protocol;

	pkt->xt.thoff = ip_hdrlen(pkt->skb);

	pkt->xt.fragoff = ntohs(ip->frag_off) & IP_OFFSET;

	pkt->thoff = ip_hdrlen(pkt->skb);

	pkt->fragoff = ntohs(ip->frag_off) & IP_OFFSET;

}



static inline int __nft_set_pktinfo_ipv4_validate(struct nft_pktinfo *pkt,

						  struct sk_buff *skb)

static inline int __nft_set_pktinfo_ipv4_validate(struct nft_pktinfo *pkt)

{

	struct iphdr *iph, _iph;

	u32 len, thoff;



	iph = skb_header_pointer(skb, skb_network_offset(skb), sizeof(*iph),

				 &_iph);

	iph = skb_header_pointer(pkt->skb, skb_network_offset(pkt->skb),

				 sizeof(*iph), &_iph);

	if (!iph)

		return -1;
@@ -33,42 +31,40 @@ static inline int __nft_set_pktinfo_ipv4_validate(struct nft_pktinfo *pkt, 


	len = ntohs(iph->tot_len);

	thoff = iph->ihl * 4;

	if (skb->len < len)

	if (pkt->skb->len < len)

		return -1;

	else if (len < thoff)

		return -1;



	pkt->tprot_set = true;

	pkt->tprot = iph->protocol;

	pkt->xt.thoff = thoff;

	pkt->xt.fragoff = ntohs(iph->frag_off) & IP_OFFSET;

	pkt->thoff = thoff;

	pkt->fragoff = ntohs(iph->frag_off) & IP_OFFSET;



	return 0;

}



static inline void nft_set_pktinfo_ipv4_validate(struct nft_pktinfo *pkt,

						 struct sk_buff *skb)

static inline void nft_set_pktinfo_ipv4_validate(struct nft_pktinfo *pkt)

{

	if (__nft_set_pktinfo_ipv4_validate(pkt, skb) < 0)

		nft_set_pktinfo_unspec(pkt, skb);

	if (__nft_set_pktinfo_ipv4_validate(pkt) < 0)

		nft_set_pktinfo_unspec(pkt);

}



static inline int nft_set_pktinfo_ipv4_ingress(struct nft_pktinfo *pkt,

					       struct sk_buff *skb)

static inline int nft_set_pktinfo_ipv4_ingress(struct nft_pktinfo *pkt)

{

	struct iphdr *iph;

	u32 len, thoff;



	if (!pskb_may_pull(skb, sizeof(*iph)))

	if (!pskb_may_pull(pkt->skb, sizeof(*iph)))

		return -1;



	iph = ip_hdr(skb);

	iph = ip_hdr(pkt->skb);

	if (iph->ihl < 5 || iph->version != 4)

		goto inhdr_error;



	len = ntohs(iph->tot_len);

	thoff = iph->ihl * 4;

	if (skb->len < len) {

	if (pkt->skb->len < len) {

		__IP_INC_STATS(nft_net(pkt), IPSTATS_MIB_INTRUNCATEDPKTS);

		return -1;

	} else if (len < thoff) {
@@ -77,8 +73,8 @@ static inline int nft_set_pktinfo_ipv4_ingress(struct nft_pktinfo *pkt, 


	pkt->tprot_set = true;

	pkt->tprot = iph->protocol;

	pkt->xt.thoff = thoff;

	pkt->xt.fragoff = ntohs(iph->frag_off) & IP_OFFSET;

	pkt->thoff = thoff;

	pkt->fragoff = ntohs(iph->frag_off) & IP_OFFSET;



	return 0;