tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge tag 'nf-next-26-01-20' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next

Florian Westphal says:

====================
Subject: netfilter: updates for net-next

1) Speed up nftables transactions after earlier transaction failed.
Due to a (harmeless) bug we remained in slow paranoia mode until
a successful transaction completes.

2) Allow generic tracker to resolve clashes, this avoids very rare
packet drops. From Yuto Hamaguchi.

3) Increase the cleanup budget to 64 entries in nf_conncount to reap
more entries in one go, from Fernando Fernandez Mancera.

4) Allow icmp trackers to resolve clashes, this avoids very rare
initial packet drop with test cases that have high-frequency pings.
After this all trackers except tcp and sctp allow clash resolution.

5) Disentangle netfilter headers, don't include nftables/xtables headers
in subsystems that are unrelated.

6) Don't rely on implicit includes coming from nf_conntrack_proto_gre.h.

7) Allow nfnetlink_queue nfq instance struct to get accounted via memcg,
from Scott Mitchell.

8) Reject bogus xt target/match data upfront via netlink policiy in
nft_compat interface rather than relying on x_tables API to do it.

9) Fix nf_conncount breakage when trying to limit loopback flows via
prerouting rule, from Fernando Fernandez Mancera.
This is a recent breakage but not seen as urgent enough to rush this
via net tree at this late stage in development cycle.

10) Fix a possible off-by-one when parsing tcp option in xtables tcpmss
match. Also handled via -next due to late stage in development
cycle.

* tag 'nf-next-26-01-20' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next:
netfilter: xt_tcpmss: check remaining length before reading optlen
netfilter: nf_conncount: fix tracking of connections from localhost
netfilter: nft_compat: add more restrictions on netlink attributes
netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation
netfilter: nf_conntrack: don't rely on implicit includes
netfilter: don't include xt and nftables.h in unrelated subsystems
netfilter: nf_conntrack: enable icmp clash support
netfilter: nf_conncount: increase the connection clean up limit to 64
netfilter: nf_conntrack: Add allow_clash to generic protocol handler
netfilter: nf_tables: reset table validation state on abort
====================

Link: https://patch.msgid.link/20260120191803.22208-1-fw@strlen.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Jakub Kicinski a7c708dc 82a6c28d

+102 -60
-1
include/linux/audit.h
··· 13 13 #include <linux/ptrace.h> 14 14 #include <linux/audit_arch.h> 15 15 #include <uapi/linux/audit.h> 16 - #include <uapi/linux/netfilter/nf_tables.h> 17 16 #include <uapi/linux/fanotify.h> 18 17 19 18 #define AUDIT_INO_UNSET ((unsigned long)-1)
-3
include/linux/netfilter/nf_conntrack_proto_gre.h
··· 1 1 /* SPDX-License-Identifier: GPL-2.0 */ 2 2 #ifndef _CONNTRACK_PROTO_GRE_H 3 3 #define _CONNTRACK_PROTO_GRE_H 4 - #include <asm/byteorder.h> 5 - #include <net/gre.h> 6 - #include <net/pptp.h> 7 4 8 5 struct nf_ct_gre { 9 6 unsigned int stream_timeout;
+1
include/net/netfilter/nf_conntrack.h
··· 16 16 #include <linux/bitops.h> 17 17 #include <linux/compiler.h> 18 18 19 + #include <net/netns/generic.h> 19 20 #include <linux/netfilter/nf_conntrack_common.h> 20 21 #include <linux/netfilter/nf_conntrack_tcp.h> 21 22 #include <linux/netfilter/nf_conntrack_sctp.h>
+1
include/net/netfilter/nf_conntrack_count.h
··· 13 13 u32 last_gc; /* jiffies at most recent gc */ 14 14 struct list_head head; /* connections with the same filtering key */ 15 15 unsigned int count; /* length of list */ 16 + unsigned int last_gc_count; /* length of list at most recent gc */ 16 17 }; 17 18 18 19 struct nf_conncount_data *nf_conncount_init(struct net *net, unsigned int keylen);
+1 -1
include/net/netfilter/nf_conntrack_tuple.h
··· 11 11 #ifndef _NF_CONNTRACK_TUPLE_H 12 12 #define _NF_CONNTRACK_TUPLE_H 13 13 14 - #include <linux/netfilter/x_tables.h> 14 + #include <linux/netfilter.h> 15 15 #include <linux/netfilter/nf_conntrack_tuple_common.h> 16 16 #include <linux/list_nulls.h> 17 17
-1
include/net/netfilter/nf_tables.h
··· 6 6 #include <linux/list.h> 7 7 #include <linux/netfilter.h> 8 8 #include <linux/netfilter/nfnetlink.h> 9 - #include <linux/netfilter/x_tables.h> 10 9 #include <linux/netfilter/nf_tables.h> 11 10 #include <linux/u64_stats_sync.h> 12 11 #include <linux/rhashtable.h>
+1 -2
net/bridge/netfilter/nf_conntrack_bridge.c
··· 16 16 #include <net/netfilter/nf_conntrack_helper.h> 17 17 #include <net/netfilter/nf_conntrack_bridge.h> 18 18 19 - #include <linux/netfilter/nf_tables.h> 20 - #include <net/netfilter/nf_tables.h> 19 + #include <linux/netfilter_ipv4.h> 21 20 22 21 #include "../br_private.h" 23 22
+23 -7
net/netfilter/nf_conncount.c
··· 34 34 35 35 #define CONNCOUNT_SLOTS 256U 36 36 37 - #define CONNCOUNT_GC_MAX_NODES 8 38 - #define MAX_KEYLEN 5 37 + #define CONNCOUNT_GC_MAX_NODES 8 38 + #define CONNCOUNT_GC_MAX_COLLECT 64 39 + #define MAX_KEYLEN 5 39 40 40 41 /* we will save the tuples of all connections we care about */ 41 42 struct nf_conncount_tuple { ··· 179 178 return -ENOENT; 180 179 181 180 if (ct && nf_ct_is_confirmed(ct)) { 182 - err = -EEXIST; 183 - goto out_put; 181 + /* local connections are confirmed in postrouting so confirmation 182 + * might have happened before hitting connlimit 183 + */ 184 + if (skb->skb_iif != LOOPBACK_IFINDEX) { 185 + err = -EEXIST; 186 + goto out_put; 187 + } 188 + 189 + /* this is likely a local connection, skip optimization to avoid 190 + * adding duplicates from a 'packet train' 191 + */ 192 + goto check_connections; 184 193 } 185 194 186 - if ((u32)jiffies == list->last_gc) 195 + if ((u32)jiffies == list->last_gc && 196 + (list->count - list->last_gc_count) < CONNCOUNT_GC_MAX_COLLECT) 187 197 goto add_new_node; 188 198 199 + check_connections: 189 200 /* check the saved connections */ 190 201 list_for_each_entry_safe(conn, conn_n, &list->head, node) { 191 - if (collect > CONNCOUNT_GC_MAX_NODES) 202 + if (collect > CONNCOUNT_GC_MAX_COLLECT) 192 203 break; 193 204 194 205 found = find_or_evict(net, list, conn); ··· 243 230 nf_ct_put(found_ct); 244 231 } 245 232 list->last_gc = (u32)jiffies; 233 + list->last_gc_count = list->count; 246 234 247 235 add_new_node: 248 236 if (WARN_ON_ONCE(list->count > INT_MAX)) { ··· 291 277 spin_lock_init(&list->list_lock); 292 278 INIT_LIST_HEAD(&list->head); 293 279 list->count = 0; 280 + list->last_gc_count = 0; 294 281 list->last_gc = (u32)jiffies; 295 282 } 296 283 EXPORT_SYMBOL_GPL(nf_conncount_list_init); ··· 331 316 } 332 317 333 318 nf_ct_put(found_ct); 334 - if (collected > CONNCOUNT_GC_MAX_NODES) 319 + if (collected > CONNCOUNT_GC_MAX_COLLECT) 335 320 break; 336 321 } 337 322 338 323 if (!list->count) 339 324 ret = true; 340 325 list->last_gc = (u32)jiffies; 326 + list->last_gc_count = list->count; 341 327 342 328 return ret; 343 329 }
+1
net/netfilter/nf_conntrack_bpf.c
··· 14 14 #include <linux/types.h> 15 15 #include <linux/btf_ids.h> 16 16 #include <linux/net_namespace.h> 17 + #include <net/sock.h> 17 18 #include <net/xdp.h> 18 19 #include <net/netfilter/nf_conntrack_bpf.h> 19 20 #include <net/netfilter/nf_conntrack_core.h>
+1
net/netfilter/nf_conntrack_h323_main.c
··· 23 23 #include <linux/skbuff.h> 24 24 #include <net/route.h> 25 25 #include <net/ip6_route.h> 26 + #include <linux/netfilter_ipv4.h> 26 27 #include <linux/netfilter_ipv6.h> 27 28 28 29 #include <net/netfilter/nf_conntrack.h>
+1
net/netfilter/nf_conntrack_netlink.c
··· 32 32 #include <linux/siphash.h> 33 33 34 34 #include <linux/netfilter.h> 35 + #include <net/ipv6.h> 35 36 #include <net/netlink.h> 36 37 #include <net/sock.h> 37 38 #include <net/netfilter/nf_conntrack.h>
+1
net/netfilter/nf_conntrack_proto_generic.c
··· 67 67 const struct nf_conntrack_l4proto nf_conntrack_l4proto_generic = 68 68 { 69 69 .l4proto = 255, 70 + .allow_clash = true, 70 71 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT 71 72 .ctnl_timeout = { 72 73 .nlattr_to_obj = generic_timeout_nlattr_to_obj,
+2
net/netfilter/nf_conntrack_proto_gre.c
··· 33 33 #include <linux/skbuff.h> 34 34 #include <linux/slab.h> 35 35 #include <net/dst.h> 36 + #include <net/gre.h> 36 37 #include <net/net_namespace.h> 37 38 #include <net/netns/generic.h> 38 39 #include <net/netfilter/nf_conntrack_l4proto.h> 39 40 #include <net/netfilter/nf_conntrack_helper.h> 40 41 #include <net/netfilter/nf_conntrack_core.h> 41 42 #include <net/netfilter/nf_conntrack_timeout.h> 43 + #include <net/pptp.h> 42 44 #include <linux/netfilter/nf_conntrack_proto_gre.h> 43 45 #include <linux/netfilter/nf_conntrack_pptp.h> 44 46
+1
net/netfilter/nf_conntrack_proto_icmp.c
··· 365 365 const struct nf_conntrack_l4proto nf_conntrack_l4proto_icmp = 366 366 { 367 367 .l4proto = IPPROTO_ICMP, 368 + .allow_clash = true, 368 369 #if IS_ENABLED(CONFIG_NF_CT_NETLINK) 369 370 .tuple_to_nlattr = icmp_tuple_to_nlattr, 370 371 .nlattr_tuple_size = icmp_nlattr_tuple_size,
+1
net/netfilter/nf_conntrack_proto_icmpv6.c
··· 343 343 const struct nf_conntrack_l4proto nf_conntrack_l4proto_icmpv6 = 344 344 { 345 345 .l4proto = IPPROTO_ICMPV6, 346 + .allow_clash = true, 346 347 #if IS_ENABLED(CONFIG_NF_CT_NETLINK) 347 348 .tuple_to_nlattr = icmpv6_tuple_to_nlattr, 348 349 .nlattr_tuple_size = icmpv6_nlattr_tuple_size,
+2
net/netfilter/nf_flow_table_ip.c
··· 8 8 #include <linux/ipv6.h> 9 9 #include <linux/netdevice.h> 10 10 #include <linux/if_ether.h> 11 + #include <linux/if_vlan.h> 12 + #include <net/gre.h> 11 13 #include <net/gso.h> 12 14 #include <net/ip.h> 13 15 #include <net/ipv6.h>
+1
net/netfilter/nf_flow_table_offload.c
··· 6 6 #include <linux/netdevice.h> 7 7 #include <linux/tc_act/tc_csum.h> 8 8 #include <net/flow_offload.h> 9 + #include <net/ip_tunnels.h> 9 10 #include <net/netfilter/nf_flow_table.h> 10 11 #include <net/netfilter/nf_tables.h> 11 12 #include <net/netfilter/nf_conntrack.h>
+1
net/netfilter/nf_flow_table_path.c
··· 2 2 #include <linux/kernel.h> 3 3 #include <linux/module.h> 4 4 #include <linux/init.h> 5 + #include <linux/etherdevice.h> 5 6 #include <linux/netlink.h> 6 7 #include <linux/netfilter.h> 7 8 #include <linux/spinlock.h>
+3
net/netfilter/nf_nat_ovs.c
··· 2 2 /* Support nat functions for openvswitch and used by OVS and TC conntrack. */ 3 3 4 4 #include <net/netfilter/nf_nat.h> 5 + #include <net/ipv6.h> 6 + #include <linux/ip.h> 7 + #include <linux/if_vlan.h> 5 8 6 9 /* Modelled after nf_nat_ipv[46]_fn(). 7 10 * range is only used for new, uninitialized NAT state.
+1
net/netfilter/nf_nat_proto.c
··· 25 25 #include <net/ip6_route.h> 26 26 #include <net/xfrm.h> 27 27 #include <net/ipv6.h> 28 + #include <net/pptp.h> 28 29 29 30 #include <net/netfilter/nf_conntrack_core.h> 30 31 #include <net/netfilter/nf_conntrack.h>
+1
net/netfilter/nf_synproxy_core.c
··· 10 10 #include <net/netns/generic.h> 11 11 #include <linux/proc_fs.h> 12 12 13 + #include <linux/netfilter_ipv4.h> 13 14 #include <linux/netfilter_ipv6.h> 14 15 #include <linux/netfilter/nf_synproxy.h> 15 16
+8
net/netfilter/nf_tables_api.c
··· 14 14 #include <linux/rhashtable.h> 15 15 #include <linux/audit.h> 16 16 #include <linux/netfilter.h> 17 + #include <linux/netfilter_ipv4.h> 17 18 #include <linux/netfilter/nfnetlink.h> 18 19 #include <linux/netfilter/nf_tables.h> 19 20 #include <net/netfilter/nf_flow_table.h> ··· 11536 11535 gc_seq = nft_gc_seq_begin(nft_net); 11537 11536 ret = __nf_tables_abort(net, action); 11538 11537 nft_gc_seq_end(nft_net, gc_seq); 11538 + 11539 + if (action == NFNL_ABORT_NONE) { 11540 + struct nft_table *table; 11541 + 11542 + list_for_each_entry(table, &nft_net->tables, list) 11543 + table->validate_state = NFT_VALIDATE_SKIP; 11544 + } 11539 11545 11540 11546 WARN_ON_ONCE(!list_empty(&nft_net->commit_list)); 11541 11547
+10 -3
net/netfilter/nft_compat.c
··· 134 134 } 135 135 136 136 static const struct nla_policy nft_target_policy[NFTA_TARGET_MAX + 1] = { 137 - [NFTA_TARGET_NAME] = { .type = NLA_NUL_STRING }, 137 + [NFTA_TARGET_NAME] = { .type = NLA_NUL_STRING, 138 + .len = XT_EXTENSION_MAXNAMELEN, }, 138 139 [NFTA_TARGET_REV] = NLA_POLICY_MAX(NLA_BE32, 255), 139 140 [NFTA_TARGET_INFO] = { .type = NLA_BINARY }, 140 141 }; ··· 435 434 } 436 435 437 436 static const struct nla_policy nft_match_policy[NFTA_MATCH_MAX + 1] = { 438 - [NFTA_MATCH_NAME] = { .type = NLA_NUL_STRING }, 437 + [NFTA_MATCH_NAME] = { .type = NLA_NUL_STRING, 438 + .len = XT_EXTENSION_MAXNAMELEN }, 439 439 [NFTA_MATCH_REV] = NLA_POLICY_MAX(NLA_BE32, 255), 440 440 [NFTA_MATCH_INFO] = { .type = NLA_BINARY }, 441 441 }; ··· 695 693 696 694 name = nla_data(tb[NFTA_COMPAT_NAME]); 697 695 rev = ntohl(nla_get_be32(tb[NFTA_COMPAT_REV])); 698 - target = ntohl(nla_get_be32(tb[NFTA_COMPAT_TYPE])); 696 + /* x_tables api checks for 'target == 1' to mean target, 697 + * everything else means 'match'. 698 + * In x_tables world, the number is set by kernel, not 699 + * userspace. 700 + */ 701 + target = nla_get_be32(tb[NFTA_COMPAT_TYPE]) == htonl(1); 699 702 700 703 switch(family) { 701 704 case AF_INET:
+1
net/netfilter/nft_flow_offload.c
··· 1 1 // SPDX-License-Identifier: GPL-2.0-only 2 + #include <linux/etherdevice.h> 2 3 #include <linux/kernel.h> 3 4 #include <linux/module.h> 4 5 #include <linux/init.h>
+1
net/netfilter/nft_synproxy.c
··· 7 7 #include <net/netfilter/nf_conntrack.h> 8 8 #include <net/netfilter/nf_conntrack_synproxy.h> 9 9 #include <net/netfilter/nf_synproxy.h> 10 + #include <linux/netfilter_ipv4.h> 10 11 #include <linux/netfilter/nf_tables.h> 11 12 #include <linux/netfilter/nf_synproxy.h> 12 13
+1 -1
net/netfilter/xt_tcpmss.c
··· 61 61 return (mssval >= info->mss_min && 62 62 mssval <= info->mss_max) ^ info->invert; 63 63 } 64 - if (op[i] < 2) 64 + if (op[i] < 2 || i == optlen - 1) 65 65 i++; 66 66 else 67 67 i += op[i+1] ? : 1;
+2
net/sched/act_ct.c
··· 13 13 #include <linux/skbuff.h> 14 14 #include <linux/rtnetlink.h> 15 15 #include <linux/pkt_cls.h> 16 + #include <linux/if_tunnel.h> 16 17 #include <linux/ip.h> 17 18 #include <linux/ipv6.h> 18 19 #include <linux/rhashtable.h> 20 + #include <net/gre.h> 19 21 #include <net/netlink.h> 20 22 #include <net/pkt_sched.h> 21 23 #include <net/pkt_cls.h>
+1
net/sched/act_ctinfo.c
··· 16 16 #include <net/pkt_sched.h> 17 17 #include <net/act_api.h> 18 18 #include <net/pkt_cls.h> 19 + #include <net/inet_ecn.h> 19 20 #include <uapi/linux/tc_act/tc_ctinfo.h> 20 21 #include <net/tc_act/tc_ctinfo.h> 21 22 #include <net/tc_wrapper.h>