Re: [PATCH nf-next v3] netfilter: nf_defrag: Skip defrag if NOTRACK is set

On 2018-01-08 06:32, Pablo Neira Ayuso wrote: Hi Subash, One more concern before this gets upstream. Do you think we can turn this into an on/off knob instead? I mean, I think it's good if you add a new NF_IP_PRI_RAW_BEFORE_DEFRAG and we place it into uapi. I'm just worried about follow up

Re: [PATCH 00/52] Netfilter/IPVS updates for net-next

From: Pablo Neira Ayuso Date: Mon, 8 Jan 2018 21:19:08 +0100 > The following patchset contains Netfilter/IPVS updates for your > net-next tree: ... > 4) Add generic flow table offload infrastructure for nf_tables, this >includes the netlink control plane and support

[PATCH v2] netfilter: nf_tables: delete table via table handle

This patch add code to delete table via unique table handle and table family. Signed-off-by: Harsha Sharma --- Changes in v2: - Remove nf_tables_afinfo_lookup_byhandle - Change log message net/netfilter/nf_tables_api.c | 45

[PATCH v3] parser_bison: extend nft to delete table via table handle

This patch allows deletion of table via unique table handles and table family which can be listed with '-a' option. For.eg. nft delete table [] [handle ] Signed-off-by: Harsha Sharma --- Changes in v3: - Add tableid_spec - Change log message Changes in v2: - remove

Re: [PATCH v2] netfilter: nf_tables: delete table via table handle

On Mon, Jan 08, 2018 at 11:28:18PM +0530, Harsha Sharma wrote: > This patch add code to delete table via unique table handle and table > family. > > Signed-off-by: Harsha Sharma > --- > Changes in v2: > - Remove nf_tables_afinfo_lookup_byhandle > - Change log

[PATCH 07/52] netfilter: ipset: use nfnl_mutex_is_locked

From: Florian Westphal Check that we really hold nfnl mutex here instead of relying on correct usage alone. Signed-off-by: Florian Westphal Acked-by: Jozsef Kadlecsik Signed-off-by: Pablo Neira Ayuso ---

[PATCH 36/52] netfilter: move route indirection to struct nf_ipv6_ops

We cannot make a direct call to nf_ip6_route() because that would result in autoloading the 'ipv6' module because of symbol dependencies. Therefore, define route indirection in nf_ipv6_ops where this really belongs to. For IPv4, we can indeed make a direct function call, which is faster, given

[PATCH 42/52] netfilter: nf_tables: remove nft_dereference()

This macro is unnecessary, it just hides details for one single caller. nfnl_dereference() is just enough. Signed-off-by: Pablo Neira Ayuso --- include/net/netfilter/nf_tables.h | 3 --- net/netfilter/nf_tables_api.c | 6 +++--- 2 files changed, 3 insertions(+), 6

[PATCH 39/52] netfilter: remove struct nf_afinfo and its helper functions

This abstraction has no clients anymore, remove it. This is what remains from previous authors, so correct copyright statement after recent modifications and code removal. Signed-off-by: Pablo Neira Ayuso --- include/linux/netfilter.h | 13 -

[PATCH 32/52] netfilter: connlimit: split xt_connlimit into front and backend

From: Florian Westphal This allows to reuse xt_connlimit infrastructure from nf_tables. The upcoming nf_tables frontend can just pass in an nftables register as input key, this allows limiting by any nft-supported key, including concatenations. For xt_connlimit, pass in the zone

[PATCH 35/52] netfilter: remove saveroute indirection in struct nf_afinfo

This is only used by nf_queue.c and this function comes with no symbol dependencies with IPv6, it just refers to structure layouts. Therefore, we can replace it by a direct function call from where it belongs. Signed-off-by: Pablo Neira Ayuso --- include/linux/netfilter.h

[PATCH 43/52] netfilter: nf_conntrack: add IPS_OFFLOAD status bit

This new bit tells us that the conntrack entry is owned by the flow table offload infrastructure. # cat /proc/net/nf_conntrack ipv4 2 tcp 6 src=10.141.10.2 dst=147.75.205.195 sport=36392 dport=443 src=147.75.205.195 dst=192.168.2.195 sport=443 dport=36392 [OFFLOAD] mark=0 zone=0

[PATCH 41/52] netfilter: remove defensive check on malformed packets from raw sockets

Users cannot forge malformed IPv4/IPv6 headers via raw sockets that they can inject into the stack. Specifically, not for IPv4 since 55888dfb6ba7 ("AF_RAW: Augment raw_send_hdrinc to expand skb to fit iphdr->ihl (v2)"). IPv6 raw sockets also ensure that packets have a well-formed IPv6 header

[PATCH 02/52] netfilter: conntrack: constify list of builtin trackers

From: Florian Westphal Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso --- include/net/netfilter/nf_conntrack_l4proto.h | 10 +- net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | 2 +-

[PATCH 10/52] netfilter: core: make nf_unregister_net_hooks simple wrapper again

From: Florian Westphal This reverts commit d3ad2c17b4047 ("netfilter: core: batch nf_unregister_net_hooks synchronize_net calls"). Nothing wrong with it. However, followup patch will delay freeing of hooks with call_rcu, so all synchronize_net() calls become obsolete and there

[PATCH 12/52] netfilter: core: free hooks with call_rcu

From: Florian Westphal Giuseppe Scrivano says: "SELinux, if enabled, registers for each new network namespace 6 netfilter hooks." Cost for this is high. With synchronize_net() removed: "The net benefit on an SMP machine with two cores is that creating a new network

[PATCH 05/52] netfilter: conntrack: timeouts can be const

From: Florian Westphal Nowadays this is just the default template that is used when setting up the net namespace, so nothing writes to these locations. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso ---

[PATCH 04/52] netfilter: mark expected switch fall-throughs

From: "Gustavo A. R. Silva" In preparation to enabling -Wimplicit-fallthrough, mark switch cases where we are expecting to fall through. Signed-off-by: Gustavo A. R. Silva Signed-off-by: Simon Horman Signed-off-by: Pablo

[PATCH 03/52] netfilter: conntrack: l4 protocol trackers can be const

From: Florian Westphal previous patches removed all writes to these structs so we can now mark them as const. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso --- include/net/netfilter/ipv4/nf_conntrack_ipv4.h | 12

[PATCH 44/52] netfilter: nf_tables: add flow table netlink frontend

This patch introduces a netlink control plane to create, delete and dump flow tables. Flow tables are identified by name, this name is used from rules to refer to an specific flow table. Flow tables use the rhashtable class and a generic garbage collector to remove expired entries. This also adds

[PATCH 51/52] netfilter: ipset: Fix "don't update counters" mode when counters used at the matching

From: Jozsef Kadlecsik The matching of the counters was not taken into account, fixed. Signed-off-by: Jozsef Kadlecsik Signed-off-by: Pablo Neira Ayuso --- include/linux/netfilter/ipset/ip_set.h | 6 ++

[PATCH 52/52] netfilter: ipset: Missing nfnl_lock()/nfnl_unlock() is added to ip_set_net_exit()

From: Jozsef Kadlecsik Patch "netfilter: ipset: use nfnl_mutex_is_locked" is added the real mutex locking check, which revealed the missing locking in ip_set_net_exit(). Signed-off-by: Jozsef Kadlecsik Reported-by:

[PATCH 50/52] netfilter: ipset: use swap macro instead of _manually_ swapping values

From: "Gustavo A. R. Silva" Make use of the swap macro and remove unnecessary variables tmp. This makes the code easier to read and maintain. This code was detected with the help of Coccinelle. Signed-off-by: Gustavo A. R. Silva Signed-off-by:

[PATCH 45/52] netfilter: add generic flow table infrastructure

This patch defines the API to interact with flow tables, this allows to add, delete and lookup for entries in the flow table. This also adds the generic garbage code that removes entries that have expired, ie. no traffic has been seen for a while. Users of the flow table infrastructure can delete

[PATCH 48/52] netfilter: flow table support for the mixed IPv4/IPv6 family

This patch adds the IPv6 flow table type, that implements the datapath flow table to forward IPv6 traffic. Signed-off-by: Pablo Neira Ayuso --- include/net/netfilter/nf_flow_table.h | 5 net/ipv4/netfilter/nf_flow_table_ipv4.c | 3 ++-

[PATCH 37/52] netfilter: move reroute indirection to struct nf_ipv6_ops

We cannot make a direct call to nf_ip6_reroute() because that would result in autoloading the 'ipv6' module because of symbol dependencies. Therefore, define reroute indirection in nf_ipv6_ops where this really belongs to. For IPv4, we can indeed make a direct function call, which is faster,

[PATCH 01/52] netfilter: conntrack: remove nlattr_size pointer from l4proto trackers

From: Florian Westphal similar to previous commit, but instead compute this at compile time and turn nlattr_size into an u16. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso --- include/net/netfilter/nf_conntrack_l4proto.h

[PATCH 00/52] Netfilter/IPVS updates for net-next

Hi David, The following patchset contains Netfilter/IPVS updates for your net-next tree: 1) Free hooks via call_rcu to speed up netns release path, from Florian Westphal. 2) Reduce memory footprint of hook arrays, skip allocation if family is not present - useful in case decnet support is

[PATCH 38/52] netfilter: remove route_key_size field in struct nf_afinfo

This is only needed by nf_queue, place this code where it belongs. Signed-off-by: Pablo Neira Ayuso --- include/linux/netfilter.h | 1 - net/ipv4/netfilter.c | 1 - net/ipv6/netfilter.c | 1 - net/netfilter/nf_queue.c | 22 -- 4 files

[PATCH 49/52] netfilter: nf_tables: flow offload expression

Add new instruction for the nf_tables VM that allows us to specify what flows are offloaded into a given flow table via name. This new instruction creates the flow entry and adds it to the flow table. Only established flows, ie. we have seen traffic in both directions, are added to the flow

[PATCH 46/52] netfilter: flow table support for IPv4

This patch adds the IPv4 flow table type, that implements the datapath flow table to forward IPv4 traffic. Rationale is: 1) Look up for the packet in the flow table, from the ingress hook. 2) If there's a hit, decrement ttl and pass it on to the neighbour layer for transmission. 3) If there's

[PATCH 40/52] netfilter: meta: secpath support

From: Florian Westphal replacement for iptables "-m policy --dir in --policy {ipsec,none}". Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso --- include/uapi/linux/netfilter/nf_tables.h | 2 ++ net/netfilter/nft_meta.c

[PATCH 31/52] netfilter: nf_tables: remove hooks from family definition

They don't belong to the family definition, move them to the filter chain type definition instead. Signed-off-by: Pablo Neira Ayuso --- include/net/netfilter/nf_tables.h | 4 +--- net/bridge/netfilter/nf_tables_bridge.c | 14 +++---

[PATCH 34/52] netfilter: move checksum_partial indirection to struct nf_ipv6_ops

We cannot make a direct call to nf_ip6_checksum_partial() because that would result in autoloading the 'ipv6' module because of symbol dependencies. Therefore, define checksum_partial indirection in nf_ipv6_ops where this really belongs to. For IPv4, we can indeed make a direct function call,

[PATCH 29/52] netfilter: nf_tables_inet: don't use multihook infrastructure anymore

Use new native NFPROTO_INET support in netfilter core, this gets rid of ad-hoc code in the nf_tables API codebase. Signed-off-by: Pablo Neira Ayuso --- include/net/netfilter/nf_tables_ipv4.h | 2 - include/net/netfilter/nf_tables_ipv6.h | 2 -

[PATCH 30/52] netfilter: nf_tables: remove multihook chains and families

Since NFPROTO_INET is handled from the core, we don't need to maintain extra infrastructure in nf_tables to handle the double hook registration, one for IPv4 and another for IPv6. Signed-off-by: Pablo Neira Ayuso --- include/net/netfilter/nf_tables.h | 9 +--

[PATCH 28/52] netfilter: core: support for NFPROTO_INET hook registration

Expand NFPROTO_INET in two hook registrations, one for NFPROTO_IPV4 and another for NFPROTO_IPV6. Hence, we handle NFPROTO_INET from the core. Signed-off-by: Pablo Neira Ayuso --- net/netfilter/core.c | 53 +++- 1 file

[PATCH 27/52] netfilter: core: pass family as parameter to nf_remove_net_hook()

So static_key_slow_dec applies to the family behind NFPROTO_INET. Signed-off-by: Pablo Neira Ayuso --- net/netfilter/core.c | 10 +- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/net/netfilter/core.c b/net/netfilter/core.c index

[PATCH 33/52] netfilter: move checksum indirection to struct nf_ipv6_ops

We cannot make a direct call to nf_ip6_checksum() because that would result in autoloading the 'ipv6' module because of symbol dependencies. Therefore, define checksum indirection in nf_ipv6_ops where this really belongs to. For IPv4, we can indeed make a direct function call, which is faster,

[PATCH 24/52] netfilter: nf_tables: add nft_set_is_anonymous() helper

Add helper function to test for the NFT_SET_ANONYMOUS flag. Signed-off-by: Pablo Neira Ayuso --- include/net/netfilter/nf_tables.h | 5 + net/netfilter/nf_tables_api.c | 8 net/netfilter/nft_dynset.c| 2 +- 3 files changed, 10 insertions(+), 5

[PATCH 26/52] netfilter: core: pass hook number, family and device to nf_find_hook_list()

Instead of passing struct nf_hook_ops, this is needed by follow up patches to handle NFPROTO_INET from the core. Signed-off-by: Pablo Neira Ayuso --- net/netfilter/core.c | 36 +++- 1 file changed, 19 insertions(+), 17 deletions(-) diff

[PATCH 23/52] netfilter: nf_tables: explicit nft_set_pktinfo() call from hook path

Instead of calling this function from the family specific variant, this reduces the code size in the fast path for the netdev, bridge and inet families. After this change, we must call nft_set_pktinfo() upfront from the chain hook indirection. Before: textdata bss dec hex

[PATCH 16/52] netfilter: don't allocate space for decnet hooks unless needed

From: Florian Westphal no need to define hook points if the family isn't supported. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso --- include/linux/netfilter.h | 2 ++ include/net/netns/netfilter.h | 2 ++

[PATCH 18/52] netfilter: reduce NF_MAX_HOOKS define

From: Florian Westphal This can be same as NF_INET_NUMHOOKS if we don't support DECNET. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso --- include/linux/netfilter_defs.h | 10 +++--- 1 file changed, 7 insertions(+), 3

[PATCH 17/52] netfilter: don't allocate space for arp/bridge hooks unless needed

From: Florian Westphal no need to define hook points if the family isn't supported. Because we need these hooks for either nftables, arp/ebtables or the 'call-iptables' hack we have in the bridge layer add two new dependencies, NETFILTER_FAMILY_{ARP,BRIDGE}, and have the users

[PATCH 25/52] netfilter: core: add nf_remove_net_hook

Just a cleanup, __nf_unregister_net_hook() is used by a follow up patch when handling NFPROTO_INET as a real family from the core. Signed-off-by: Pablo Neira Ayuso --- net/netfilter/core.c | 8 1 file changed, 4 insertions(+), 4 deletions(-) diff --git

[PATCH 09/52] netfilter: nf_conntrack_h323: Remove unwanted comments.

From: Varsha Rao Change old multi-line comment style to kernel comment style and remove unwanted comments. Signed-off-by: Varsha Rao Signed-off-by: Pablo Neira Ayuso --- net/netfilter/nf_conntrack_h323_asn1.c | 37

[PATCH 06/52] netfilter: ipvs: Remove useless ipvsh param of frag_safe_skb_hp

From: Gao Feng The param of frag_safe_skb_hp, ipvsh, isn't used now. So remove it and update the callers' codes too. Signed-off-by: Gao Feng Acked-by: Simon Horman Signed-off-by: Pablo Neira Ayuso

[PATCH 19/52] netfilter: xtables: add and use xt_request_find_table_lock

From: Florian Westphal currently we always return -ENOENT to userspace if we can't find a particular table, or if the table initialization fails. Followup patch will make nat table init fail in case nftables already registered a nat hook so this change makes xt_find_table_lock

[PATCH 22/52] netfilter: nf_tables_arp: don't set forward chain

46928a0b49f3 ("netfilter: nf_tables: remove multihook chains and families") already removed this, this is a leftover. Signed-off-by: Pablo Neira Ayuso --- net/ipv4/netfilter/nf_tables_arp.c | 1 - 1 file changed, 1 deletion(-) diff --git

[PATCH 13/52] netfilter: reduce size of hook entry point locations

From: Florian Westphal struct net contains: struct nf_hook_entries __rcu *hooks[NFPROTO_NUMPROTO][NF_MAX_HOOKS]; which store the hook entry point locations for the various protocol families and the hooks. Using array results in compact c code when doing accesses, i.e. x =

[PATCH 20/52] netfilter: core: only allow one nat hook per hook point

From: Florian Westphal The netfilter NAT core cannot deal with more than one NAT hook per hook location (prerouting, input ...), because the NAT hooks install a NAT null binding in case the iptables nat table (iptable_nat hooks) or the corresponding nftables chain (nft nat hooks)

[PATCH 11/52] netfilter: core: remove synchronize_net call if nfqueue is used

From: Florian Westphal since commit 960632ece6949b ("netfilter: convert hook list to an array") nfqueue no longer stores a pointer to the hook that caused the packet to be queued. Therefore no extra synchronize_net() call is needed after dropping the packets enqueued by the old

[PATCH 21/52] netfilter: nf_tables: reject nat hook registration if prio is before conntrack

From: Florian Westphal No problem for iptables as priorities are fixed values defined in the nat modules, but in nftables the priority its coming from userspace. Reject in case we see that such a hook would not work. Signed-off-by: Florian Westphal

[PATCH 14/52] netfilter: add defines for arp/decnet max hooks

From: Florian Westphal The kernel already has defines for this, but they are in uapi exposed headers. Including these from netns.h causes build errors and also adds unneeded dependencies on heads that we don't need. So move these defines to netfilter_defs.h and place the uapi

Re: [PATCH nf-next] netfilter: avoid arp/bridge WARN_ON if arp/ebtables not supported

On Mon, Jan 08, 2018 at 01:31:52PM +0100, Florian Westphal wrote: > We need to retain the 'case' statement, otherwise, if e.g. arp tables > isn't supported first NF_HOOK(NFPROTO_ARP, ... will produce a bogus > WARN_ON(). Applied, thanks Florian. -- To unsubscribe from this list: send the line

Re: [PATCH nf-next v3] netfilter: nf_defrag: Skip defrag if NOTRACK is set

Hi Subash, One more concern before this gets upstream. On Wed, Jan 03, 2018 at 09:24:47PM -0700, Subash Abhinov Kasiviswanathan wrote: > conntrack defrag is needed only if some module like CONNTRACK or NAT > explicitly requests it. For plain forwarding scenarios, defrag is > not needed and can

Re: [net-next v2] netfilter: add segment routing header 'srh' match

On Sun, Jan 07, 2018 at 07:22:02PM +0100, Ahmed Abdelsalam wrote: > It allows matching packets based on Segment Routing Header > (SRH) information. > The implementation considers revision 7 of the SRH draft. > https://tools.ietf.org/html/draft-ietf-6man-segment-routing-header-07 > > Currently

Re: [net-next v2] netfilter: add segment routing header 'srh' match

On Mon, Jan 08, 2018 at 02:45:16PM +0100, Ahmed AbdelSalam wrote: > > > On 8 Jan 2018, at 14:37, Pablo Neira Ayuso wrote: > > > > On Sun, Jan 07, 2018 at 07:22:02PM +0100, Ahmed Abdelsalam wrote: > >> It allows matching packets based on Segment Routing Header > >> (SRH)

Re: [PATCH 0/3] ipset patches for nf-next

On Sat, Jan 06, 2018 at 04:36:06PM +0100, Jozsef Kadlecsik wrote: > Hi Pablo, > > Please consider to apply the next patches: > > - A patch to use the swap() macro instead of the manual coding > from Gustavo A. R. Silva > - A fix to take into account the possible counter value matching > for

[PATCH nf-next] netfilter: avoid arp/bridge WARN_ON if arp/ebtables not supported

We need to retain the 'case' statement, otherwise, if e.g. arp tables isn't supported first NF_HOOK(NFPROTO_ARP, ... will produce a bogus WARN_ON(). Fixes: 8de98f05836 ("netfilter: don't allocate space for arp/bridge hooks unless needed") Signed-off-by: Florian Westphal ---

Rebasing nf-next

kbuild test robot reports a compilation error in rhashtable_walk_start() in the new net/netfilter/nf_flow_table.c, given this has changed in net-next. Sorry for the inconvenience. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to

[RFC PATCH nf-next] netfilter: nf_tables: nft_flow_offload_type can be static

Fixes: db2ff0f2f440 ("netfilter: nf_tables: flow offload expression") Signed-off-by: Fengguang Wu --- nft_flow_offload.c |2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c index