Commit 26a3beee authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge tag 'nf-next-24-11-15' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next 

Pablo Neira Ayuso says:

====================
Netfilter updates for net-next

The following patchset contains Netfilter updates for net-next:

1) Extended netlink error reporting if nfnetlink attribute parser fails,
   from Donald Hunter.

2) Incorrect request_module() module, from Simon Horman.

3) A series of patches to reduce memory consumption for set element
   transactions.
   Florian Westphal says:

"When doing a flush on a set or mass adding/removing elements from a
set, each element needs to allocate 96 bytes to hold the transactional
state.

In such cases, virtually all the information in struct nft_trans_elem
is the same.

Change nft_trans_elem to a flex-array, i.e. a single nft_trans_elem
can hold multiple set element pointers.

The number of elements that can be stored in one nft_trans_elem is limited
by the slab allocator, this series limits the compaction to at most 62
elements as it caps the reallocation to 2048 bytes of memory."

4) A series of patches to prepare the transition to dscp_t in .flowi_tos.
   From Guillaume Nault.

5) Support for bitwise operations with two source registers,
   from Jeremy Sowden.

* tag 'nf-next-24-11-15' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next:
  netfilter: bitwise: add support for doing AND, OR and XOR directly
  netfilter: bitwise: rename some boolean operation functions
  netfilter: nf_dup4: Convert nf_dup_ipv4_route() to dscp_t.
  netfilter: nft_fib: Convert nft_fib4_eval() to dscp_t.
  netfilter: rpfilter: Convert rpfilter_mt() to dscp_t.
  netfilter: flow_offload: Convert nft_flow_route() to dscp_t.
  netfilter: ipv4: Convert ip_route_me_harder() to dscp_t.
  netfilter: nf_tables: allocate element update information dynamically
  netfilter: nf_tables: switch trans_elem to real flex array
  netfilter: nf_tables: prepare nft audit for set element compaction
  netfilter: nf_tables: prepare for multiple elements in nft_trans_elem structure
  netfilter: nf_tables: add nft_trans_commit_list_add_elem helper
  netfilter: bpf: Pass string literal as format argument of request_module()
  netfilter: nfnetlink: Report extack policy errors for batched ops
====================

Link: https://patch.msgid.link/20241115133207.8907-1-pablo@netfilter.org


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents dfc14664 b0ccf4f5

include/net/netfilter/nf_tables.h

+13 −12
Original line number Diff line number Diff line
@@ -1759,28 +1759,29 @@ enum nft_trans_elem_flags { 
	NFT_TRANS_UPD_EXPIRATION	= (1 << 1),

};



struct nft_elem_update {

	u64				timeout;

	u64				expiration;

	u8				flags;

};



struct nft_trans_one_elem {

	struct nft_elem_priv		*priv;

	struct nft_elem_update		*update;

};



struct nft_trans_elem {

	struct nft_trans		nft_trans;

	struct nft_set			*set;

	struct nft_elem_priv		*elem_priv;

	u64				timeout;

	u64				expiration;

	u8				update_flags;

	bool				bound;

	unsigned int			nelems;

	struct nft_trans_one_elem	elems[] __counted_by(nelems);

};



#define nft_trans_container_elem(t)			\

	container_of(t, struct nft_trans_elem, nft_trans)

#define nft_trans_elem_set(trans)			\

	nft_trans_container_elem(trans)->set

#define nft_trans_elem_priv(trans)			\

	nft_trans_container_elem(trans)->elem_priv

#define nft_trans_elem_update_flags(trans)		\

	nft_trans_container_elem(trans)->update_flags

#define nft_trans_elem_timeout(trans)			\

	nft_trans_container_elem(trans)->timeout

#define nft_trans_elem_expiration(trans)		\

	nft_trans_container_elem(trans)->expiration

#define nft_trans_elem_set_bound(trans)			\

	nft_trans_container_elem(trans)->bound

include/uapi/linux/netfilter/nf_tables.h

+15 −3
Original line number Diff line number Diff line
@@ -564,16 +564,26 @@ enum nft_immediate_attributes { 
/**

 * enum nft_bitwise_ops - nf_tables bitwise operations

 *

 * @NFT_BITWISE_BOOL: mask-and-xor operation used to implement NOT, AND, OR and

 *                    XOR boolean operations

 * @NFT_BITWISE_MASK_XOR: mask-and-xor operation used to implement NOT, AND, OR

 *                        and XOR boolean operations

 * @NFT_BITWISE_LSHIFT: left-shift operation

 * @NFT_BITWISE_RSHIFT: right-shift operation

 * @NFT_BITWISE_AND: and operation

 * @NFT_BITWISE_OR: or operation

 * @NFT_BITWISE_XOR: xor operation

 */

enum nft_bitwise_ops {

	NFT_BITWISE_BOOL,

	NFT_BITWISE_MASK_XOR,

	NFT_BITWISE_LSHIFT,

	NFT_BITWISE_RSHIFT,

	NFT_BITWISE_AND,

	NFT_BITWISE_OR,

	NFT_BITWISE_XOR,

};

/*

 * Old name for NFT_BITWISE_MASK_XOR.  Retained for backwards-compatibility.

 */

#define NFT_BITWISE_BOOL NFT_BITWISE_MASK_XOR



/**

 * enum nft_bitwise_attributes - nf_tables bitwise expression netlink attributes
@@ -586,6 +596,7 @@ enum nft_bitwise_ops { 
 * @NFTA_BITWISE_OP: type of operation (NLA_U32: nft_bitwise_ops)

 * @NFTA_BITWISE_DATA: argument for non-boolean operations

 *                     (NLA_NESTED: nft_data_attributes)

 * @NFTA_BITWISE_SREG2: second source register (NLA_U32: nft_registers)

 *

 * The bitwise expression supports boolean and shift operations.  It implements

 * the boolean operations by performing the following operation:
@@ -609,6 +620,7 @@ enum nft_bitwise_attributes { 
	NFTA_BITWISE_XOR,

	NFTA_BITWISE_OP,

	NFTA_BITWISE_DATA,

	NFTA_BITWISE_SREG2,

	__NFTA_BITWISE_MAX

};

#define NFTA_BITWISE_MAX	(__NFTA_BITWISE_MAX - 1)

net/ipv4/netfilter.c

+1 −1
Original line number Diff line number Diff line
@@ -44,7 +44,7 @@ int ip_route_me_harder(struct net *net, struct sock *sk, struct sk_buff *skb, un 
	 */

	fl4.daddr = iph->daddr;

	fl4.saddr = saddr;

	fl4.flowi4_tos = iph->tos & INET_DSCP_MASK;

	fl4.flowi4_tos = inet_dscp_to_dsfield(ip4h_dscp(iph));

	fl4.flowi4_oif = sk ? sk->sk_bound_dev_if : 0;

	fl4.flowi4_l3mdev = l3mdev_master_ifindex(dev);

	fl4.flowi4_mark = skb->mark;

net/ipv4/netfilter/ipt_rpfilter.c

+1 −1
Original line number Diff line number Diff line
@@ -76,7 +76,7 @@ static bool rpfilter_mt(const struct sk_buff *skb, struct xt_action_param *par) 
	flow.daddr = iph->saddr;

	flow.saddr = rpfilter_get_saddr(iph->daddr);

	flow.flowi4_mark = info->flags & XT_RPFILTER_VALID_MARK ? skb->mark : 0;

	flow.flowi4_tos = iph->tos & INET_DSCP_MASK;

	flow.flowi4_tos = inet_dscp_to_dsfield(ip4h_dscp(iph));

	flow.flowi4_scope = RT_SCOPE_UNIVERSE;

	flow.flowi4_l3mdev = l3mdev_master_ifindex_rcu(xt_in(par));

	flow.flowi4_uid = sock_net_uid(xt_net(par), NULL);

net/ipv4/netfilter/nf_dup_ipv4.c

+1 −1
Original line number Diff line number Diff line
@@ -33,7 +33,7 @@ static bool nf_dup_ipv4_route(struct net *net, struct sk_buff *skb, 
		fl4.flowi4_oif = oif;



	fl4.daddr = gw->s_addr;

	fl4.flowi4_tos = iph->tos & INET_DSCP_MASK;

	fl4.flowi4_tos = inet_dscp_to_dsfield(ip4h_dscp(iph));

	fl4.flowi4_scope = RT_SCOPE_UNIVERSE;

	fl4.flowi4_flags = FLOWI_FLAG_KNOWN_NH;

	rt = ip_route_output_key(net, &fl4);