Skip to content

Commit

Permalink
Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next
Browse files Browse the repository at this point in the history 
Pablo Neira Ayuso says:

====================
Netfilter/IPVS updates for net-next

The following patchset contains Netfilter/IPVS updates for net-next:

1) Rename mss field to mss_option field in synproxy, from Fernando Mancera.

2) Use SYSCTL_{ZERO,ONE} definitions in conntrack, from Matteo Croce.

3) More strict validation of IPVS sysctl values, from Junwei Hu.

4) Remove unnecessary spaces after on the right hand side of assignments,
   from yangxingwu.

5) Add offload support for bitwise operation.

6) Extend the nft_offload_reg structure to store immediate date.

7) Collapse several ip_set header files into ip_set.h, from
   Jeremy Sowden.

8) Make netfilter headers compile with CONFIG_KERNEL_HEADER_TEST=y,
   from Jeremy Sowden.

9) Fix several sparse warnings due to missing prototypes, from
   Valdis Kletnieks.

10) Use static lock initialiser to ensure connlabel spinlock is
    initialized on boot time to fix sched/act_ct.c, patch
    from Florian Westphal.
====================

Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
  • Loading branch information
Jakub Kicinski committed Aug 14, 2019
2 parents b753c5a + 1053334 commit c162610
Show file tree
Hide file tree
Showing 76 changed files with 527 additions and 480 deletions.
74 changes: 0 additions & 74 deletions include/Kbuild
View file
Original file line number Diff line number Diff line change
Expand Up @@ -386,31 +386,6 @@ header-test- += linux/mvebu-pmsu.h
header-test- += linux/mxm-wmi.h
header-test- += linux/n_r3964.h
header-test- += linux/ndctl.h
header-test- += linux/netfilter/ipset/ip_set.h
header-test- += linux/netfilter/ipset/ip_set_bitmap.h
header-test- += linux/netfilter/ipset/ip_set_comment.h
header-test- += linux/netfilter/ipset/ip_set_counter.h
header-test- += linux/netfilter/ipset/ip_set_getport.h
header-test- += linux/netfilter/ipset/ip_set_hash.h
header-test- += linux/netfilter/ipset/ip_set_list.h
header-test- += linux/netfilter/ipset/ip_set_skbinfo.h
header-test- += linux/netfilter/ipset/ip_set_timeout.h
header-test- += linux/netfilter/nf_conntrack_amanda.h
header-test- += linux/netfilter/nf_conntrack_ftp.h
header-test- += linux/netfilter/nf_conntrack_h323.h
header-test- += linux/netfilter/nf_conntrack_h323_asn1.h
header-test- += linux/netfilter/nf_conntrack_irc.h
header-test- += linux/netfilter/nf_conntrack_pptp.h
header-test- += linux/netfilter/nf_conntrack_proto_gre.h
header-test- += linux/netfilter/nf_conntrack_sip.h
header-test- += linux/netfilter/nf_conntrack_snmp.h
header-test- += linux/netfilter/nf_conntrack_tftp.h
header-test- += linux/netfilter/x_tables.h
header-test- += linux/netfilter_arp/arp_tables.h
header-test- += linux/netfilter_bridge/ebtables.h
header-test- += linux/netfilter_ipv4/ip4_tables.h
header-test- += linux/netfilter_ipv4/ip_tables.h
header-test- += linux/netfilter_ipv6/ip6_tables.h
header-test- += linux/nfs.h
header-test- += linux/nfs_fs_i.h
header-test- += linux/nfs_fs_sb.h
Expand Down Expand Up @@ -874,43 +849,6 @@ header-test- += net/mpls_iptunnel.h
header-test- += net/mrp.h
header-test- += net/ncsi.h
header-test- += net/netevent.h
header-test- += net/netfilter/br_netfilter.h
header-test- += net/netfilter/ipv4/nf_dup_ipv4.h
header-test- += net/netfilter/ipv6/nf_defrag_ipv6.h
header-test- += net/netfilter/ipv6/nf_dup_ipv6.h
header-test- += net/netfilter/nf_conntrack.h
header-test- += net/netfilter/nf_conntrack_acct.h
header-test- += net/netfilter/nf_conntrack_bridge.h
header-test- += net/netfilter/nf_conntrack_core.h
header-test- += net/netfilter/nf_conntrack_count.h
header-test- += net/netfilter/nf_conntrack_ecache.h
header-test- += net/netfilter/nf_conntrack_expect.h
header-test- += net/netfilter/nf_conntrack_extend.h
header-test- += net/netfilter/nf_conntrack_helper.h
header-test- += net/netfilter/nf_conntrack_l4proto.h
header-test- += net/netfilter/nf_conntrack_labels.h
header-test- += net/netfilter/nf_conntrack_seqadj.h
header-test- += net/netfilter/nf_conntrack_synproxy.h
header-test- += net/netfilter/nf_conntrack_timeout.h
header-test- += net/netfilter/nf_conntrack_timestamp.h
header-test- += net/netfilter/nf_conntrack_tuple.h
header-test- += net/netfilter/nf_dup_netdev.h
header-test- += net/netfilter/nf_flow_table.h
header-test- += net/netfilter/nf_nat.h
header-test- += net/netfilter/nf_nat_helper.h
header-test- += net/netfilter/nf_nat_masquerade.h
header-test- += net/netfilter/nf_nat_redirect.h
header-test- += net/netfilter/nf_queue.h
header-test- += net/netfilter/nf_reject.h
header-test- += net/netfilter/nf_synproxy.h
header-test-$(CONFIG_NF_TABLES) += net/netfilter/nf_tables.h
header-test-$(CONFIG_NF_TABLES) += net/netfilter/nf_tables_core.h
header-test-$(CONFIG_NF_TABLES) += net/netfilter/nf_tables_ipv4.h
header-test- += net/netfilter/nf_tables_ipv6.h
header-test-$(CONFIG_NF_TABLES) += net/netfilter/nf_tables_offload.h
header-test- += net/netfilter/nft_fib.h
header-test- += net/netfilter/nft_meta.h
header-test- += net/netfilter/nft_reject.h
header-test- += net/netns/can.h
header-test- += net/netns/generic.h
header-test- += net/netns/ieee802154_6lowpan.h
Expand Down Expand Up @@ -1140,18 +1078,6 @@ header-test- += uapi/linux/kvm_para.h
header-test- += uapi/linux/lightnvm.h
header-test- += uapi/linux/mic_common.h
header-test- += uapi/linux/mman.h
header-test- += uapi/linux/netfilter/ipset/ip_set_bitmap.h
header-test- += uapi/linux/netfilter/ipset/ip_set_hash.h
header-test- += uapi/linux/netfilter/ipset/ip_set_list.h
header-test- += uapi/linux/netfilter/nf_synproxy.h
header-test- += uapi/linux/netfilter/xt_policy.h
header-test- += uapi/linux/netfilter/xt_set.h
header-test- += uapi/linux/netfilter_arp/arp_tables.h
header-test- += uapi/linux/netfilter_arp/arpt_mangle.h
header-test- += uapi/linux/netfilter_ipv4/ip_tables.h
header-test- += uapi/linux/netfilter_ipv4/ipt_LOG.h
header-test- += uapi/linux/netfilter_ipv6/ip6_tables.h
header-test- += uapi/linux/netfilter_ipv6/ip6t_LOG.h
header-test- += uapi/linux/nilfs2_ondisk.h
header-test- += uapi/linux/patchkey.h
header-test- += uapi/linux/ptrace.h
Expand Down
238 changes: 234 additions & 4 deletions include/linux/netfilter/ipset/ip_set.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -452,10 +452,240 @@ bitmap_bytes(u32 a, u32 b)
return 4 * ((((b - a + 8) / 8) + 3) / 4);
}

#include <linux/netfilter/ipset/ip_set_timeout.h>
#include <linux/netfilter/ipset/ip_set_comment.h>
#include <linux/netfilter/ipset/ip_set_counter.h>
#include <linux/netfilter/ipset/ip_set_skbinfo.h>
/* How often should the gc be run by default */
#define IPSET_GC_TIME (3 * 60)

/* Timeout period depending on the timeout value of the given set */
#define IPSET_GC_PERIOD(timeout) \
((timeout/3) ? min_t(u32, (timeout)/3, IPSET_GC_TIME) : 1)

/* Entry is set with no timeout value */
#define IPSET_ELEM_PERMANENT 0

/* Set is defined with timeout support: timeout value may be 0 */
#define IPSET_NO_TIMEOUT UINT_MAX

/* Max timeout value, see msecs_to_jiffies() in jiffies.h */
#define IPSET_MAX_TIMEOUT (UINT_MAX >> 1)/MSEC_PER_SEC

#define ip_set_adt_opt_timeout(opt, set) \
((opt)->ext.timeout != IPSET_NO_TIMEOUT ? (opt)->ext.timeout : (set)->timeout)

static inline unsigned int
ip_set_timeout_uget(struct nlattr *tb)
{
unsigned int timeout = ip_set_get_h32(tb);

/* Normalize to fit into jiffies */
if (timeout > IPSET_MAX_TIMEOUT)
timeout = IPSET_MAX_TIMEOUT;

return timeout;
}

static inline bool
ip_set_timeout_expired(const unsigned long *t)
{
return *t != IPSET_ELEM_PERMANENT && time_is_before_jiffies(*t);
}

static inline void
ip_set_timeout_set(unsigned long *timeout, u32 value)
{
unsigned long t;

if (!value) {
*timeout = IPSET_ELEM_PERMANENT;
return;
}

t = msecs_to_jiffies(value * MSEC_PER_SEC) + jiffies;
if (t == IPSET_ELEM_PERMANENT)
/* Bingo! :-) */
t--;
*timeout = t;
}

static inline u32
ip_set_timeout_get(const unsigned long *timeout)
{
u32 t;

if (*timeout == IPSET_ELEM_PERMANENT)
return 0;

t = jiffies_to_msecs(*timeout - jiffies)/MSEC_PER_SEC;
/* Zero value in userspace means no timeout */
return t == 0 ? 1 : t;
}

static inline char*
ip_set_comment_uget(struct nlattr *tb)
{
return nla_data(tb);
}

/* Called from uadd only, protected by the set spinlock.
* The kadt functions don't use the comment extensions in any way.
*/
static inline void
ip_set_init_comment(struct ip_set *set, struct ip_set_comment *comment,
const struct ip_set_ext *ext)
{
struct ip_set_comment_rcu *c = rcu_dereference_protected(comment->c, 1);
size_t len = ext->comment ? strlen(ext->comment) : 0;

if (unlikely(c)) {
set->ext_size -= sizeof(*c) + strlen(c->str) + 1;
kfree_rcu(c, rcu);
rcu_assign_pointer(comment->c, NULL);
}
if (!len)
return;
if (unlikely(len > IPSET_MAX_COMMENT_SIZE))
len = IPSET_MAX_COMMENT_SIZE;
c = kmalloc(sizeof(*c) + len + 1, GFP_ATOMIC);
if (unlikely(!c))
return;
strlcpy(c->str, ext->comment, len + 1);
set->ext_size += sizeof(*c) + strlen(c->str) + 1;
rcu_assign_pointer(comment->c, c);
}

/* Used only when dumping a set, protected by rcu_read_lock() */
static inline int
ip_set_put_comment(struct sk_buff *skb, const struct ip_set_comment *comment)
{
struct ip_set_comment_rcu *c = rcu_dereference(comment->c);

if (!c)
return 0;
return nla_put_string(skb, IPSET_ATTR_COMMENT, c->str);
}

/* Called from uadd/udel, flush or the garbage collectors protected
* by the set spinlock.
* Called when the set is destroyed and when there can't be any user
* of the set data anymore.
*/
static inline void
ip_set_comment_free(struct ip_set *set, struct ip_set_comment *comment)
{
struct ip_set_comment_rcu *c;

c = rcu_dereference_protected(comment->c, 1);
if (unlikely(!c))
return;
set->ext_size -= sizeof(*c) + strlen(c->str) + 1;
kfree_rcu(c, rcu);
rcu_assign_pointer(comment->c, NULL);
}

static inline void
ip_set_add_bytes(u64 bytes, struct ip_set_counter *counter)
{
atomic64_add((long long)bytes, &(counter)->bytes);
}

static inline void
ip_set_add_packets(u64 packets, struct ip_set_counter *counter)
{
atomic64_add((long long)packets, &(counter)->packets);
}

static inline u64
ip_set_get_bytes(const struct ip_set_counter *counter)
{
return (u64)atomic64_read(&(counter)->bytes);
}

static inline u64
ip_set_get_packets(const struct ip_set_counter *counter)
{
return (u64)atomic64_read(&(counter)->packets);
}

static inline bool
ip_set_match_counter(u64 counter, u64 match, u8 op)
{
switch (op) {
case IPSET_COUNTER_NONE:
return true;
case IPSET_COUNTER_EQ:
return counter == match;
case IPSET_COUNTER_NE:
return counter != match;
case IPSET_COUNTER_LT:
return counter < match;
case IPSET_COUNTER_GT:
return counter > match;
}
return false;
}

static inline void
ip_set_update_counter(struct ip_set_counter *counter,
const struct ip_set_ext *ext, u32 flags)
{
if (ext->packets != ULLONG_MAX &&
!(flags & IPSET_FLAG_SKIP_COUNTER_UPDATE)) {
ip_set_add_bytes(ext->bytes, counter);
ip_set_add_packets(ext->packets, counter);
}
}

static inline bool
ip_set_put_counter(struct sk_buff *skb, const struct ip_set_counter *counter)
{
return nla_put_net64(skb, IPSET_ATTR_BYTES,
cpu_to_be64(ip_set_get_bytes(counter)),
IPSET_ATTR_PAD) ||
nla_put_net64(skb, IPSET_ATTR_PACKETS,
cpu_to_be64(ip_set_get_packets(counter)),
IPSET_ATTR_PAD);
}

static inline void
ip_set_init_counter(struct ip_set_counter *counter,
const struct ip_set_ext *ext)
{
if (ext->bytes != ULLONG_MAX)
atomic64_set(&(counter)->bytes, (long long)(ext->bytes));
if (ext->packets != ULLONG_MAX)
atomic64_set(&(counter)->packets, (long long)(ext->packets));
}

static inline void
ip_set_get_skbinfo(struct ip_set_skbinfo *skbinfo,
const struct ip_set_ext *ext,
struct ip_set_ext *mext, u32 flags)
{
mext->skbinfo = *skbinfo;
}

static inline bool
ip_set_put_skbinfo(struct sk_buff *skb, const struct ip_set_skbinfo *skbinfo)
{
/* Send nonzero parameters only */
return ((skbinfo->skbmark || skbinfo->skbmarkmask) &&
nla_put_net64(skb, IPSET_ATTR_SKBMARK,
cpu_to_be64((u64)skbinfo->skbmark << 32 |
skbinfo->skbmarkmask),
IPSET_ATTR_PAD)) ||
(skbinfo->skbprio &&
nla_put_net32(skb, IPSET_ATTR_SKBPRIO,
cpu_to_be32(skbinfo->skbprio))) ||
(skbinfo->skbqueue &&
nla_put_net16(skb, IPSET_ATTR_SKBQUEUE,
cpu_to_be16(skbinfo->skbqueue)));
}

static inline void
ip_set_init_skbinfo(struct ip_set_skbinfo *skbinfo,
const struct ip_set_ext *ext)
{
*skbinfo = ext->skbinfo;
}

#define IP_SET_INIT_KEXT(skb, opt, set) \
{ .bytes = (skb)->len, .packets = 1, \
Expand Down
Loading

0 comments on commit c162610

Please sign in to comment.