Commit 12a7c6a9 authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge tag 'nf-next-25-10-30' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next 

Florian Westphal says:

====================
netfilter: updates for net-next

1) Convert nf_tables 'nft_set_iter' usage to use C99 struct
   initialization, from Fernando Fernandez Mancera.
2) Disallow nf_conntrack_max=0.  This was an (undocumented)
   historic inheritance from ip_conntrack (ipv4 only nf_conntrack
   predecessor).  Doing so will simplify future changes to make
   this pernet-tuneable.
3) Fix a typo in conntrack.h comment, from Weibiao Tu.

* tag 'nf-next-25-10-30' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next:
  netfilter: fix typo in nf_conntrack_l4proto.h comment
  netfilter: conntrack: disable 0 value for conntrack_max setting
  netfilter: nf_tables: use C99 struct initializer for nft_set_iter
====================

Link: https://patch.msgid.link/20251030121954.29175-1-fw@strlen.de


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents 1659b441 57347d58

include/net/netfilter/nf_conntrack_l4proto.h

+1 −1
Original line number Diff line number Diff line
@@ -30,7 +30,7 @@ struct nf_conntrack_l4proto { 
	/* called by gc worker if table is full */

	bool (*can_early_drop)(const struct nf_conn *ct);



	/* convert protoinfo to nfnetink attributes */

	/* convert protoinfo to nfnetlink attributes */

	int (*to_nlattr)(struct sk_buff *skb, struct nlattr *nla,

			 struct nf_conn *ct, bool destroy);

net/netfilter/nf_conntrack_core.c

+1 −1
Original line number Diff line number Diff line
@@ -1668,7 +1668,7 @@ __nf_conntrack_alloc(struct net *net, 
	/* We don't want any race condition at early drop stage */

	ct_count = atomic_inc_return(&cnet->count);



	if (nf_conntrack_max && unlikely(ct_count > nf_conntrack_max)) {

	if (unlikely(ct_count > nf_conntrack_max)) {

		if (!early_drop(net, hash)) {

			if (!conntrack_gc_work.early_drop)

				conntrack_gc_work.early_drop = true;

net/netfilter/nf_conntrack_standalone.c

+2 −2
Original line number Diff line number Diff line
@@ -648,7 +648,7 @@ static struct ctl_table nf_ct_sysctl_table[] = { 
		.maxlen		= sizeof(int),

		.mode		= 0644,

		.proc_handler	= proc_dointvec_minmax,

		.extra1		= SYSCTL_ZERO,

		.extra1		= SYSCTL_ONE,

		.extra2		= SYSCTL_INT_MAX,

	},

	[NF_SYSCTL_CT_COUNT] = {
@@ -929,7 +929,7 @@ static struct ctl_table nf_ct_netfilter_table[] = { 
		.maxlen		= sizeof(int),

		.mode		= 0644,

		.proc_handler	= proc_dointvec_minmax,

		.extra1		= SYSCTL_ZERO,

		.extra1		= SYSCTL_ONE,

		.extra2		= SYSCTL_INT_MAX,

	},

};

net/netfilter/nf_tables_api.c

+16 −18
Original line number Diff line number Diff line
@@ -5770,7 +5770,11 @@ int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set, 
		       struct nft_set_binding *binding)

{

	struct nft_set_binding *i;

	struct nft_set_iter iter;

	struct nft_set_iter iter = {

		.genmask	= nft_genmask_next(ctx->net),

		.type		= NFT_ITER_UPDATE,

		.fn		= nf_tables_bind_check_setelem,

	};



	if (!list_empty(&set->bindings) && nft_set_is_anonymous(set))

		return -EBUSY;
@@ -5785,13 +5789,6 @@ int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set, 
				goto bind;

		}



		iter.genmask	= nft_genmask_next(ctx->net);

		iter.type	= NFT_ITER_UPDATE;

		iter.skip 	= 0;

		iter.count	= 0;

		iter.err	= 0;

		iter.fn		= nf_tables_bind_check_setelem;



		set->ops->walk(ctx, set, &iter);

		if (!iter.err)

			iter.err = nft_set_catchall_bind_check(ctx, set);
@@ -6195,7 +6192,17 @@ static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb) 
	struct nftables_pernet *nft_net;

	struct nft_table *table;

	struct nft_set *set;

	struct nft_set_dump_args args;

	struct nft_set_dump_args args = {

		.cb = cb,

		.skb = skb,

		.reset = dump_ctx->reset,

		.iter = {

			.genmask = nft_genmask_cur(net),

			.type = NFT_ITER_READ,

			.skip = cb->args[0],

			.fn = nf_tables_dump_setelem,

		},

	};

	bool set_found = false;

	struct nlmsghdr *nlh;

	struct nlattr *nest;
@@ -6246,15 +6253,6 @@ static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb) 
	if (nest == NULL)

		goto nla_put_failure;



	args.cb			= cb;

	args.skb		= skb;

	args.reset		= dump_ctx->reset;

	args.iter.genmask	= nft_genmask_cur(net);

	args.iter.type		= NFT_ITER_READ;

	args.iter.skip		= cb->args[0];

	args.iter.count		= 0;

	args.iter.err		= 0;

	args.iter.fn		= nf_tables_dump_setelem;

	set->ops->walk(&dump_ctx->ctx, set, &args.iter);



	if (!args.iter.err && args.iter.count == cb->args[0])

net/netfilter/nft_lookup.c

+5 −8
Original line number Diff line number Diff line
@@ -246,19 +246,16 @@ static int nft_lookup_validate(const struct nft_ctx *ctx, 
			       const struct nft_expr *expr)

{

	const struct nft_lookup *priv = nft_expr_priv(expr);

	struct nft_set_iter iter;

	struct nft_set_iter iter = {

		.genmask	= nft_genmask_next(ctx->net),

		.type		= NFT_ITER_UPDATE,

		.fn		= nft_setelem_validate,

	};



	if (!(priv->set->flags & NFT_SET_MAP) ||

	    priv->set->dtype != NFT_DATA_VERDICT)

		return 0;



	iter.genmask	= nft_genmask_next(ctx->net);

	iter.type	= NFT_ITER_UPDATE;

	iter.skip	= 0;

	iter.count	= 0;

	iter.err	= 0;

	iter.fn		= nft_setelem_validate;



	priv->set->ops->walk(ctx, priv->set, &iter);

	if (!iter.err)

		iter.err = nft_set_catchall_validate(ctx, priv->set);