diff options
Diffstat (limited to 'target/linux/generic/backport-4.19')
107 files changed, 19110 insertions, 0 deletions
diff --git a/target/linux/generic/backport-4.19/010-Kbuild-don-t-hardcode-path-to-awk-in-scripts-ld-vers.patch b/target/linux/generic/backport-4.19/010-Kbuild-don-t-hardcode-path-to-awk-in-scripts-ld-vers.patch new file mode 100644 index 0000000000..7ac4f9d240 --- /dev/null +++ b/target/linux/generic/backport-4.19/010-Kbuild-don-t-hardcode-path-to-awk-in-scripts-ld-vers.patch @@ -0,0 +1,30 @@ +From 13b1ecc3401653a355798eb1dee10cc1608202f4 Mon Sep 17 00:00:00 2001 +From: Felix Fietkau <nbd@nbd.name> +Date: Mon, 18 Jan 2016 12:27:49 +0100 +Subject: [PATCH 33/34] Kbuild: don't hardcode path to awk in + scripts/ld-version.sh + +On some systems /usr/bin/awk does not exist, or is broken. Find it via +$PATH instead. + +Signed-off-by: Felix Fietkau <nbd@nbd.name> +--- + scripts/ld-version.sh | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/scripts/ld-version.sh ++++ b/scripts/ld-version.sh +@@ -1,6 +1,7 @@ +-#!/usr/bin/awk -f ++#!/bin/sh + # SPDX-License-Identifier: GPL-2.0 + # extract linker version number from stdin and turn into single number ++exec awk ' + { + gsub(".*\\)", ""); + gsub(".*version ", ""); +@@ -9,3 +10,4 @@ + print a[1]*100000000 + a[2]*1000000 + a[3]*10000; + exit + } ++' diff --git a/target/linux/generic/backport-4.19/011-kbuild-export-SUBARCH.patch b/target/linux/generic/backport-4.19/011-kbuild-export-SUBARCH.patch new file mode 100644 index 0000000000..3df01c34b1 --- /dev/null +++ b/target/linux/generic/backport-4.19/011-kbuild-export-SUBARCH.patch @@ -0,0 +1,23 @@ +From 173019b66dcc9d68ad9333aa744dad1e369b5aa8 Mon Sep 17 00:00:00 2001 +From: Felix Fietkau <nbd@nbd.name> +Date: Sun, 9 Jul 2017 00:26:53 +0200 +Subject: [PATCH 34/34] kernel: add compile fix for linux 4.9 on x86 + +Signed-off-by: Felix Fietkau <nbd@nbd.name> +--- + Makefile | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/Makefile ++++ b/Makefile +@@ -428,8 +428,8 @@ KBUILD_CFLAGS_MODULE := -DMODULE + KBUILD_LDFLAGS_MODULE := -T $(srctree)/scripts/module-common.lds + GCC_PLUGINS_CFLAGS := + +-export ARCH SRCARCH CONFIG_SHELL HOSTCC HOSTCFLAGS CROSS_COMPILE AS LD CC +-export CPP AR NM STRIP OBJCOPY OBJDUMP HOSTLDFLAGS HOST_LOADLIBES ++export ARCH SRCARCH SUBARCH CONFIG_SHELL HOSTCC HOSTCFLAGS CROSS_COMPILE AS LD ++export CC CPP AR NM STRIP OBJCOPY OBJDUMP HOSTLDFLAGS HOST_LOADLIBES + export MAKE AWK GENKSYMS INSTALLKERNEL PERL PYTHON UTS_MACHINE + export HOSTCXX HOSTCXXFLAGS LDFLAGS_MODULE CHECK CHECKFLAGS + diff --git a/target/linux/generic/backport-4.19/012-kbuild-add-macro-for-controlling-warnings-to-linux-c.patch b/target/linux/generic/backport-4.19/012-kbuild-add-macro-for-controlling-warnings-to-linux-c.patch new file mode 100644 index 0000000000..7617c2e5f5 --- /dev/null +++ b/target/linux/generic/backport-4.19/012-kbuild-add-macro-for-controlling-warnings-to-linux-c.patch @@ -0,0 +1,140 @@ +From: Arnd Bergmann <arnd@arndb.de> +Date: Tue, 19 Jun 2018 13:14:56 -0700 +Subject: [PATCH] kbuild: add macro for controlling warnings to + linux/compiler.h + +I have occasionally run into a situation where it would make sense to +control a compiler warning from a source file rather than doing so from +a Makefile using the $(cc-disable-warning, ...) or $(cc-option, ...) +helpers. + +The approach here is similar to what glibc uses, using __diag() and +related macros to encapsulate a _Pragma("GCC diagnostic ...") statement +that gets turned into the respective "#pragma GCC diagnostic ..." by +the preprocessor when the macro gets expanded. + +Like glibc, I also have an argument to pass the affected compiler +version, but decided to actually evaluate that one. For now, this +supports GCC_4_6, GCC_4_7, GCC_4_8, GCC_4_9, GCC_5, GCC_6, GCC_7, +GCC_8 and GCC_9. Adding support for CLANG_5 and other interesting +versions is straightforward here. GNU compilers starting with gcc-4.2 +could support it in principle, but "#pragma GCC diagnostic push" +was only added in gcc-4.6, so it seems simpler to not deal with those +at all. The same versions show a large number of warnings already, +so it seems easier to just leave it at that and not do a more +fine-grained control for them. + +The use cases I found so far include: + +- turning off the gcc-8 -Wattribute-alias warning inside of the + SYSCALL_DEFINEx() macro without having to do it globally. + +- Reducing the build time for a simple re-make after a change, + once we move the warnings from ./Makefile and + ./scripts/Makefile.extrawarn into linux/compiler.h + +- More control over the warnings based on other configurations, + using preprocessor syntax instead of Makefile syntax. This should make + it easier for the average developer to understand and change things. + +- Adding an easy way to turn the W=1 option on unconditionally + for a subdirectory or a specific file. This has been requested + by several developers in the past that want to have their subsystems + W=1 clean. + +- Integrating clang better into the build systems. Clang supports + more warnings than GCC, and we probably want to classify them + as default, W=1, W=2 etc, but there are cases in which the + warnings should be classified differently due to excessive false + positives from one or the other compiler. + +- Adding a way to turn the default warnings into errors (e.g. using + a new "make E=0" tag) while not also turning the W=1 warnings into + errors. + +This patch for now just adds the minimal infrastructure in order to +do the first of the list above. As the #pragma GCC diagnostic +takes precedence over command line options, the next step would be +to convert a lot of the individual Makefiles that set nonstandard +options to use __diag() instead. + +[paul.burton@mips.com: + - Rebase atop current master. + - Add __diag_GCC, or more generally __diag_<compiler>, abstraction to + avoid code outside of linux/compiler-gcc.h needing to duplicate + knowledge about different GCC versions. + - Add a comment argument to __diag_{ignore,warn,error} which isn't + used in the expansion of the macros but serves to push people to + document the reason for using them - per feedback from Kees Cook. + - Translate severity to GCC-specific pragmas in linux/compiler-gcc.h + rather than using GCC-specific in linux/compiler_types.h. + - Drop all but GCC 8 macros, since we only need to define macros for + versions that we need to introduce pragmas for, and as of this + series that's just GCC 8. + - Capitalize comments in linux/compiler-gcc.h to match the style of + the rest of the file. + - Line up macro definitions with tabs in linux/compiler-gcc.h.] + +Signed-off-by: Arnd Bergmann <arnd@arndb.de> +Signed-off-by: Paul Burton <paul.burton@mips.com> +Tested-by: Christophe Leroy <christophe.leroy@c-s.fr> +Tested-by: Stafford Horne <shorne@gmail.com> +Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com> +--- + +--- a/include/linux/compiler-gcc.h ++++ b/include/linux/compiler-gcc.h +@@ -358,3 +358,28 @@ + * code + */ + #define uninitialized_var(x) x = x ++ ++/* ++ * Turn individual warnings and errors on and off locally, depending ++ * on version. ++ */ ++#define __diag_GCC(version, severity, s) \ ++ __diag_GCC_ ## version(__diag_GCC_ ## severity s) ++ ++/* Severity used in pragma directives */ ++#define __diag_GCC_ignore ignored ++#define __diag_GCC_warn warning ++#define __diag_GCC_error error ++ ++/* Compilers before gcc-4.6 do not understand "#pragma GCC diagnostic push" */ ++#if GCC_VERSION >= 40600 ++#define __diag_str1(s) #s ++#define __diag_str(s) __diag_str1(s) ++#define __diag(s) _Pragma(__diag_str(GCC diagnostic s)) ++#endif ++ ++#if GCC_VERSION >= 80000 ++#define __diag_GCC_8(s) __diag(s) ++#else ++#define __diag_GCC_8(s) ++#endif +--- a/include/linux/compiler_types.h ++++ b/include/linux/compiler_types.h +@@ -283,4 +283,22 @@ struct ftrace_likely_data { + # define __native_word(t) (sizeof(t) == sizeof(char) || sizeof(t) == sizeof(short) || sizeof(t) == sizeof(int) || sizeof(t) == sizeof(long)) + #endif + ++#ifndef __diag ++#define __diag(string) ++#endif ++ ++#ifndef __diag_GCC ++#define __diag_GCC(version, severity, string) ++#endif ++ ++#define __diag_push() __diag(push) ++#define __diag_pop() __diag(pop) ++ ++#define __diag_ignore(compiler, version, option, comment) \ ++ __diag_ ## compiler(version, ignore, option) ++#define __diag_warn(compiler, version, option, comment) \ ++ __diag_ ## compiler(version, warn, option) ++#define __diag_error(compiler, version, option, comment) \ ++ __diag_ ## compiler(version, error, option) ++ + #endif /* __LINUX_COMPILER_TYPES_H */ diff --git a/target/linux/generic/backport-4.19/013-disable-Wattribute-alias-warning-for-SYSCALL_DEFINEx.patch b/target/linux/generic/backport-4.19/013-disable-Wattribute-alias-warning-for-SYSCALL_DEFINEx.patch new file mode 100644 index 0000000000..2440ed8c0d --- /dev/null +++ b/target/linux/generic/backport-4.19/013-disable-Wattribute-alias-warning-for-SYSCALL_DEFINEx.patch @@ -0,0 +1,88 @@ +From: Arnd Bergmann <arnd@arndb.de> +Date: Tue, 19 Jun 2018 13:14:57 -0700 +Subject: [PATCH] disable -Wattribute-alias warning for SYSCALL_DEFINEx() + +gcc-8 warns for every single definition of a system call entry +point, e.g.: + +include/linux/compat.h:56:18: error: 'compat_sys_rt_sigprocmask' alias between functions of incompatible types 'long int(int, compat_sigset_t *, compat_sigset_t *, compat_size_t)' {aka 'long int(int, struct <anonymous> *, struct <anonymous> *, unsigned int)'} and 'long int(long int, long int, long int, long int)' [-Werror=attribute-alias] + asmlinkage long compat_sys##name(__MAP(x,__SC_DECL,__VA_ARGS__))\ + ^~~~~~~~~~ +include/linux/compat.h:45:2: note: in expansion of macro 'COMPAT_SYSCALL_DEFINEx' + COMPAT_SYSCALL_DEFINEx(4, _##name, __VA_ARGS__) + ^~~~~~~~~~~~~~~~~~~~~~ +kernel/signal.c:2601:1: note: in expansion of macro 'COMPAT_SYSCALL_DEFINE4' + COMPAT_SYSCALL_DEFINE4(rt_sigprocmask, int, how, compat_sigset_t __user *, nset, + ^~~~~~~~~~~~~~~~~~~~~~ +include/linux/compat.h:60:18: note: aliased declaration here + asmlinkage long compat_SyS##name(__MAP(x,__SC_LONG,__VA_ARGS__))\ + ^~~~~~~~~~ + +The new warning seems reasonable in principle, but it doesn't +help us here, since we rely on the type mismatch to sanitize the +system call arguments. After I reported this as GCC PR82435, a new +-Wno-attribute-alias option was added that could be used to turn the +warning off globally on the command line, but I'd prefer to do it a +little more fine-grained. + +Interestingly, turning a warning off and on again inside of +a single macro doesn't always work, in this case I had to add +an extra statement inbetween and decided to copy the __SC_TEST +one from the native syscall to the compat syscall macro. See +https://gcc.gnu.org/bugzilla/show_bug.cgi?id=83256 for more details +about this. + +[paul.burton@mips.com: + - Rebase atop current master. + - Split GCC & version arguments to __diag_ignore() in order to match + changes to the preceding patch. + - Add the comment argument to match the preceding patch.] + +Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=82435 +Signed-off-by: Arnd Bergmann <arnd@arndb.de> +Signed-off-by: Paul Burton <paul.burton@mips.com> +Tested-by: Christophe Leroy <christophe.leroy@c-s.fr> +Tested-by: Stafford Horne <shorne@gmail.com> +Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com> +--- + +--- a/include/linux/compat.h ++++ b/include/linux/compat.h +@@ -48,6 +48,9 @@ + COMPAT_SYSCALL_DEFINEx(6, _##name, __VA_ARGS__) + + #define COMPAT_SYSCALL_DEFINEx(x, name, ...) \ ++ __diag_push(); \ ++ __diag_ignore(GCC, 8, "-Wattribute-alias", \ ++ "Type aliasing is used to sanitize syscall arguments");\ + asmlinkage long compat_sys##name(__MAP(x,__SC_DECL,__VA_ARGS__))\ + __attribute__((alias(__stringify(compat_SyS##name)))); \ + static inline long C_SYSC##name(__MAP(x,__SC_DECL,__VA_ARGS__));\ +@@ -56,6 +59,7 @@ + { \ + return C_SYSC##name(__MAP(x,__SC_DELOUSE,__VA_ARGS__)); \ + } \ ++ __diag_pop(); \ + static inline long C_SYSC##name(__MAP(x,__SC_DECL,__VA_ARGS__)) + + #ifndef compat_user_stack_pointer +--- a/include/linux/syscalls.h ++++ b/include/linux/syscalls.h +@@ -208,6 +208,9 @@ static inline int is_syscall_trace_event + + #define __PROTECT(...) asmlinkage_protect(__VA_ARGS__) + #define __SYSCALL_DEFINEx(x, name, ...) \ ++ __diag_push(); \ ++ __diag_ignore(GCC, 8, "-Wattribute-alias", \ ++ "Type aliasing is used to sanitize syscall arguments");\ + asmlinkage long sys##name(__MAP(x,__SC_DECL,__VA_ARGS__)) \ + __attribute__((alias(__stringify(SyS##name)))); \ + static inline long SYSC##name(__MAP(x,__SC_DECL,__VA_ARGS__)); \ +@@ -219,6 +222,7 @@ static inline int is_syscall_trace_event + __PROTECT(x, ret,__MAP(x,__SC_ARGS,__VA_ARGS__)); \ + return ret; \ + } \ ++ __diag_pop(); \ + static inline long SYSC##name(__MAP(x,__SC_DECL,__VA_ARGS__)) + + /* diff --git a/target/linux/generic/backport-4.19/020-backport_netfilter_rtcache.patch b/target/linux/generic/backport-4.19/020-backport_netfilter_rtcache.patch new file mode 100644 index 0000000000..8a6fba4307 --- /dev/null +++ b/target/linux/generic/backport-4.19/020-backport_netfilter_rtcache.patch @@ -0,0 +1,558 @@ +From 1bb0c3ec899827cfa4668bb63a08713a40744d21 Mon Sep 17 00:00:00 2001 +From: Florian Westphal <fw@strlen.de> +Date: Sun, 9 Jul 2017 08:58:30 +0200 +Subject: [PATCH] netfilter: conntrack: cache route for forwarded connections + +... to avoid per-packet FIB lookup if possible. + +The cached dst is re-used provided the input interface +is the same as that of the previous packet in the same direction. + +If not, the cached dst is invalidated. + +For ipv6 we also need to store sernum, else dst_check doesn't work, +pointed out by Eric Dumazet. + +This should speed up forwarding when conntrack is already in use +anyway, especially when using reverse path filtering -- active RPF +enforces two FIB lookups for each packet. + +Before the routing cache removal this didn't matter since RPF was performed +only when route cache didn't yield a result; but without route cache it +comes at higher price. + +Julian Anastasov suggested to add NETDEV_UNREGISTER handler to +avoid holding on to dsts of 'frozen' conntracks. + +Signed-off-by: Florian Westphal <fw@strlen.de> +--- + include/net/netfilter/nf_conntrack_extend.h | 4 + + include/net/netfilter/nf_conntrack_rtcache.h | 34 +++ + net/netfilter/Kconfig | 12 + + net/netfilter/Makefile | 3 + + net/netfilter/nf_conntrack_rtcache.c | 428 +++++++++++++++++++++++++++ + 5 files changed, 481 insertions(+) + create mode 100644 include/net/netfilter/nf_conntrack_rtcache.h + create mode 100644 net/netfilter/nf_conntrack_rtcache.c + +--- a/include/net/netfilter/nf_conntrack_extend.h ++++ b/include/net/netfilter/nf_conntrack_extend.h +@@ -28,6 +28,9 @@ enum nf_ct_ext_id { + #if IS_ENABLED(CONFIG_NETFILTER_SYNPROXY) + NF_CT_EXT_SYNPROXY, + #endif ++#if IS_ENABLED(CONFIG_NF_CONNTRACK_RTCACHE) ++ NF_CT_EXT_RTCACHE, ++#endif + NF_CT_EXT_NUM, + }; + +@@ -40,6 +43,7 @@ enum nf_ct_ext_id { + #define NF_CT_EXT_TIMEOUT_TYPE struct nf_conn_timeout + #define NF_CT_EXT_LABELS_TYPE struct nf_conn_labels + #define NF_CT_EXT_SYNPROXY_TYPE struct nf_conn_synproxy ++#define NF_CT_EXT_RTCACHE_TYPE struct nf_conn_rtcache + + /* Extensions: optional stuff which isn't permanently in struct. */ + struct nf_ct_ext { +--- /dev/null ++++ b/include/net/netfilter/nf_conntrack_rtcache.h +@@ -0,0 +1,34 @@ ++#include <linux/gfp.h> ++#include <net/netfilter/nf_conntrack.h> ++#include <net/netfilter/nf_conntrack_extend.h> ++ ++struct dst_entry; ++ ++struct nf_conn_dst_cache { ++ struct dst_entry *dst; ++ int iif; ++#if IS_ENABLED(CONFIG_NF_CONNTRACK_IPV6) ++ u32 cookie; ++#endif ++ ++}; ++ ++struct nf_conn_rtcache { ++ struct nf_conn_dst_cache cached_dst[IP_CT_DIR_MAX]; ++}; ++ ++static inline ++struct nf_conn_rtcache *nf_ct_rtcache_find(const struct nf_conn *ct) ++{ ++#if IS_ENABLED(CONFIG_NF_CONNTRACK_RTCACHE) ++ return nf_ct_ext_find(ct, NF_CT_EXT_RTCACHE); ++#else ++ return NULL; ++#endif ++} ++ ++static inline int nf_conn_rtcache_iif_get(const struct nf_conn_rtcache *rtc, ++ enum ip_conntrack_dir dir) ++{ ++ return rtc->cached_dst[dir].iif; ++} +--- a/net/netfilter/Kconfig ++++ b/net/netfilter/Kconfig +@@ -118,6 +118,18 @@ config NF_CONNTRACK_EVENTS + + If unsure, say `N'. + ++config NF_CONNTRACK_RTCACHE ++ tristate "Cache route entries in conntrack objects" ++ depends on NETFILTER_ADVANCED ++ depends on NF_CONNTRACK ++ help ++ If this option is enabled, the connection tracking code will ++ cache routing information for each connection that is being ++ forwarded, at a cost of 32 bytes per conntrack object. ++ ++ To compile it as a module, choose M here. If unsure, say N. ++ The module will be called nf_conntrack_rtcache. ++ + config NF_CONNTRACK_TIMEOUT + bool 'Connection tracking timeout' + depends on NETFILTER_ADVANCED +--- a/net/netfilter/Makefile ++++ b/net/netfilter/Makefile +@@ -19,6 +19,9 @@ obj-$(CONFIG_NETFILTER_NETLINK_LOG) += n + # connection tracking + obj-$(CONFIG_NF_CONNTRACK) += nf_conntrack.o + ++# optional conntrack route cache extension ++obj-$(CONFIG_NF_CONNTRACK_RTCACHE) += nf_conntrack_rtcache.o ++ + obj-$(CONFIG_NF_CT_PROTO_GRE) += nf_conntrack_proto_gre.o + + # netlink interface for nf_conntrack +--- /dev/null ++++ b/net/netfilter/nf_conntrack_rtcache.c +@@ -0,0 +1,428 @@ ++/* route cache for netfilter. ++ * ++ * (C) 2014 Red Hat GmbH ++ * ++ * This program is free software; you can redistribute it and/or modify ++ * it under the terms of the GNU General Public License version 2 as ++ * published by the Free Software Foundation. ++ */ ++ ++#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt ++ ++#include <linux/types.h> ++#include <linux/netfilter.h> ++#include <linux/skbuff.h> ++#include <linux/stddef.h> ++#include <linux/kernel.h> ++#include <linux/netdevice.h> ++#include <linux/export.h> ++#include <linux/module.h> ++ ++#include <net/dst.h> ++ ++#include <net/netfilter/nf_conntrack.h> ++#include <net/netfilter/nf_conntrack_core.h> ++#include <net/netfilter/nf_conntrack_extend.h> ++#include <net/netfilter/nf_conntrack_rtcache.h> ++ ++#if IS_ENABLED(CONFIG_NF_CONNTRACK_IPV6) ++#include <net/ip6_fib.h> ++#endif ++ ++static void __nf_conn_rtcache_destroy(struct nf_conn_rtcache *rtc, ++ enum ip_conntrack_dir dir) ++{ ++ struct dst_entry *dst = rtc->cached_dst[dir].dst; ++ ++ dst_release(dst); ++} ++ ++static void nf_conn_rtcache_destroy(struct nf_conn *ct) ++{ ++ struct nf_conn_rtcache *rtc = nf_ct_rtcache_find(ct); ++ ++ if (!rtc) ++ return; ++ ++ __nf_conn_rtcache_destroy(rtc, IP_CT_DIR_ORIGINAL); ++ __nf_conn_rtcache_destroy(rtc, IP_CT_DIR_REPLY); ++} ++ ++static void nf_ct_rtcache_ext_add(struct nf_conn *ct) ++{ ++ struct nf_conn_rtcache *rtc; ++ ++ rtc = nf_ct_ext_add(ct, NF_CT_EXT_RTCACHE, GFP_ATOMIC); ++ if (rtc) { ++ rtc->cached_dst[IP_CT_DIR_ORIGINAL].iif = -1; ++ rtc->cached_dst[IP_CT_DIR_ORIGINAL].dst = NULL; ++ rtc->cached_dst[IP_CT_DIR_REPLY].iif = -1; ++ rtc->cached_dst[IP_CT_DIR_REPLY].dst = NULL; ++ } ++} ++ ++static struct nf_conn_rtcache *nf_ct_rtcache_find_usable(struct nf_conn *ct) ++{ ++ return nf_ct_rtcache_find(ct); ++} ++ ++static struct dst_entry * ++nf_conn_rtcache_dst_get(const struct nf_conn_rtcache *rtc, ++ enum ip_conntrack_dir dir) ++{ ++ return rtc->cached_dst[dir].dst; ++} ++ ++static u32 nf_rtcache_get_cookie(int pf, const struct dst_entry *dst) ++{ ++#if IS_ENABLED(CONFIG_NF_CONNTRACK_IPV6) ++ if (pf == NFPROTO_IPV6) { ++ const struct rt6_info *rt = (const struct rt6_info *)dst; ++ ++ if (rt->rt6i_node) ++ return (u32)rt->rt6i_node->fn_sernum; ++ } ++#endif ++ return 0; ++} ++ ++static void nf_conn_rtcache_dst_set(int pf, ++ struct nf_conn_rtcache *rtc, ++ struct dst_entry *dst, ++ enum ip_conntrack_dir dir, int iif) ++{ ++ if (rtc->cached_dst[dir].iif != iif) ++ rtc->cached_dst[dir].iif = iif; ++ ++ if (rtc->cached_dst[dir].dst != dst) { ++ struct dst_entry *old; ++ ++ dst_hold(dst); ++ ++ old = xchg(&rtc->cached_dst[dir].dst, dst); ++ dst_release(old); ++ ++#if IS_ENABLED(CONFIG_NF_CONNTRACK_IPV6) ++ if (pf == NFPROTO_IPV6) ++ rtc->cached_dst[dir].cookie = ++ nf_rtcache_get_cookie(pf, dst); ++#endif ++ } ++} ++ ++static void nf_conn_rtcache_dst_obsolete(struct nf_conn_rtcache *rtc, ++ enum ip_conntrack_dir dir) ++{ ++ struct dst_entry *old; ++ ++ pr_debug("Invalidate iif %d for dir %d on cache %p\n", ++ rtc->cached_dst[dir].iif, dir, rtc); ++ ++ old = xchg(&rtc->cached_dst[dir].dst, NULL); ++ dst_release(old); ++ rtc->cached_dst[dir].iif = -1; ++} ++ ++static unsigned int nf_rtcache_in(u_int8_t pf, ++ struct sk_buff *skb, ++ const struct nf_hook_state *state) ++{ ++ struct nf_conn_rtcache *rtc; ++ enum ip_conntrack_info ctinfo; ++ enum ip_conntrack_dir dir; ++ struct dst_entry *dst; ++ struct nf_conn *ct; ++ int iif; ++ u32 cookie; ++ ++ if (skb_dst(skb) || skb->sk) ++ return NF_ACCEPT; ++ ++ ct = nf_ct_get(skb, &ctinfo); ++ if (!ct) ++ return NF_ACCEPT; ++ ++ rtc = nf_ct_rtcache_find_usable(ct); ++ if (!rtc) ++ return NF_ACCEPT; ++ ++ /* if iif changes, don't use cache and let ip stack ++ * do route lookup. ++ * ++ * If rp_filter is enabled it might toss skb, so ++ * we don't want to avoid these checks. ++ */ ++ dir = CTINFO2DIR(ctinfo); ++ iif = nf_conn_rtcache_iif_get(rtc, dir); ++ if (state->in->ifindex != iif) { ++ pr_debug("ct %p, iif %d, cached iif %d, skip cached entry\n", ++ ct, iif, state->in->ifindex); ++ return NF_ACCEPT; ++ } ++ dst = nf_conn_rtcache_dst_get(rtc, dir); ++ if (dst == NULL) ++ return NF_ACCEPT; ++ ++ cookie = nf_rtcache_get_cookie(pf, dst); ++ ++ dst = dst_check(dst, cookie); ++ pr_debug("obtained dst %p for skb %p, cookie %d\n", dst, skb, cookie); ++ if (likely(dst)) ++ skb_dst_set_noref(skb, dst); ++ else ++ nf_conn_rtcache_dst_obsolete(rtc, dir); ++ ++ return NF_ACCEPT; ++} ++ ++static unsigned int nf_rtcache_forward(u_int8_t pf, ++ struct sk_buff *skb, ++ const struct nf_hook_state *state) ++{ ++ struct nf_conn_rtcache *rtc; ++ enum ip_conntrack_info ctinfo; ++ enum ip_conntrack_dir dir; ++ struct nf_conn *ct; ++ struct dst_entry *dst = skb_dst(skb); ++ int iif; ++ ++ ct = nf_ct_get(skb, &ctinfo); ++ if (!ct) ++ return NF_ACCEPT; ++ ++ if (dst && dst_xfrm(dst)) ++ return NF_ACCEPT; ++ ++ if (!nf_ct_is_confirmed(ct)) { ++ if (WARN_ON(nf_ct_rtcache_find(ct))) ++ return NF_ACCEPT; ++ nf_ct_rtcache_ext_add(ct); ++ return NF_ACCEPT; ++ } ++ ++ rtc = nf_ct_rtcache_find_usable(ct); ++ if (!rtc) ++ return NF_ACCEPT; ++ ++ dir = CTINFO2DIR(ctinfo); ++ iif = nf_conn_rtcache_iif_get(rtc, dir); ++ pr_debug("ct %p, skb %p, dir %d, iif %d, cached iif %d\n", ++ ct, skb, dir, iif, state->in->ifindex); ++ if (likely(state->in->ifindex == iif)) ++ return NF_ACCEPT; ++ ++ nf_conn_rtcache_dst_set(pf, rtc, skb_dst(skb), dir, state->in->ifindex); ++ return NF_ACCEPT; ++} ++ ++static unsigned int nf_rtcache_in4(void *priv, ++ struct sk_buff *skb, ++ const struct nf_hook_state *state) ++{ ++ return nf_rtcache_in(NFPROTO_IPV4, skb, state); ++} ++ ++static unsigned int nf_rtcache_forward4(void *priv, ++ struct sk_buff *skb, ++ const struct nf_hook_state *state) ++{ ++ return nf_rtcache_forward(NFPROTO_IPV4, skb, state); ++} ++ ++#if IS_ENABLED(CONFIG_NF_CONNTRACK_IPV6) ++static unsigned int nf_rtcache_in6(void *priv, ++ struct sk_buff *skb, ++ const struct nf_hook_state *state) ++{ ++ return nf_rtcache_in(NFPROTO_IPV6, skb, state); ++} ++ ++static unsigned int nf_rtcache_forward6(void *priv, ++ struct sk_buff *skb, ++ const struct nf_hook_state *state) ++{ ++ return nf_rtcache_forward(NFPROTO_IPV6, skb, state); ++} ++#endif ++ ++static int nf_rtcache_dst_remove(struct nf_conn *ct, void *data) ++{ ++ struct nf_conn_rtcache *rtc = nf_ct_rtcache_find(ct); ++ struct net_device *dev = data; ++ ++ if (!rtc) ++ return 0; ++ ++ if (dev->ifindex == rtc->cached_dst[IP_CT_DIR_ORIGINAL].iif || ++ dev->ifindex == rtc->cached_dst[IP_CT_DIR_REPLY].iif) { ++ nf_conn_rtcache_dst_obsolete(rtc, IP_CT_DIR_ORIGINAL); ++ nf_conn_rtcache_dst_obsolete(rtc, IP_CT_DIR_REPLY); ++ } ++ ++ return 0; ++} ++ ++static int nf_rtcache_netdev_event(struct notifier_block *this, ++ unsigned long event, void *ptr) ++{ ++ struct net_device *dev = netdev_notifier_info_to_dev(ptr); ++ struct net *net = dev_net(dev); ++ ++ if (event == NETDEV_DOWN) ++ nf_ct_iterate_cleanup_net(net, nf_rtcache_dst_remove, dev, 0, 0); ++ ++ return NOTIFY_DONE; ++} ++ ++static struct notifier_block nf_rtcache_notifier = { ++ .notifier_call = nf_rtcache_netdev_event, ++}; ++ ++static struct nf_hook_ops rtcache_ops[] = { ++ { ++ .hook = nf_rtcache_in4, ++ .pf = NFPROTO_IPV4, ++ .hooknum = NF_INET_PRE_ROUTING, ++ .priority = NF_IP_PRI_LAST, ++ }, ++ { ++ .hook = nf_rtcache_forward4, ++ .pf = NFPROTO_IPV4, ++ .hooknum = NF_INET_FORWARD, ++ .priority = NF_IP_PRI_LAST, ++ }, ++#if IS_ENABLED(CONFIG_NF_CONNTRACK_IPV6) ++ { ++ .hook = nf_rtcache_in6, ++ .pf = NFPROTO_IPV6, ++ .hooknum = NF_INET_PRE_ROUTING, ++ .priority = NF_IP_PRI_LAST, ++ }, ++ { ++ .hook = nf_rtcache_forward6, ++ .pf = NFPROTO_IPV6, ++ .hooknum = NF_INET_FORWARD, ++ .priority = NF_IP_PRI_LAST, ++ }, ++#endif ++}; ++ ++static struct nf_ct_ext_type rtcache_extend __read_mostly = { ++ .len = sizeof(struct nf_conn_rtcache), ++ .align = __alignof__(struct nf_conn_rtcache), ++ .id = NF_CT_EXT_RTCACHE, ++ .destroy = nf_conn_rtcache_destroy, ++}; ++ ++static void __net_exit rtcache_net_exit(struct net *net) ++{ ++ /* remove hooks so no new connections get rtcache extension */ ++ nf_unregister_net_hooks(net, rtcache_ops, ARRAY_SIZE(rtcache_ops)); ++} ++ ++static struct pernet_operations rtcache_ops_net_ops = { ++ .exit = rtcache_net_exit, ++}; ++ ++static int __init nf_conntrack_rtcache_init(void) ++{ ++ int ret = nf_ct_extend_register(&rtcache_extend); ++ ++ if (ret < 0) { ++ pr_err("nf_conntrack_rtcache: Unable to register extension\n"); ++ return ret; ++ } ++ ++ ret = register_pernet_subsys(&rtcache_ops_net_ops); ++ if (ret) { ++ nf_ct_extend_unregister(&rtcache_extend); ++ return ret; ++ } ++ ++ ret = nf_register_net_hooks(&init_net, rtcache_ops, ++ ARRAY_SIZE(rtcache_ops)); ++ if (ret < 0) { ++ nf_ct_extend_unregister(&rtcache_extend); ++ unregister_pernet_subsys(&rtcache_ops_net_ops); ++ return ret; ++ } ++ ++ ret = register_netdevice_notifier(&nf_rtcache_notifier); ++ if (ret) { ++ nf_unregister_net_hooks(&init_net, rtcache_ops, ++ ARRAY_SIZE(rtcache_ops)); ++ nf_ct_extend_unregister(&rtcache_extend); ++ unregister_pernet_subsys(&rtcache_ops_net_ops); ++ } ++ ++ return ret; ++} ++ ++static int nf_rtcache_ext_remove(struct nf_conn *ct, void *data) ++{ ++ struct nf_conn_rtcache *rtc = nf_ct_rtcache_find(ct); ++ ++ return rtc != NULL; ++} ++ ++static bool __exit nf_conntrack_rtcache_wait_for_dying(struct net *net) ++{ ++ bool wait = false; ++ int cpu; ++ ++ for_each_possible_cpu(cpu) { ++ struct nf_conntrack_tuple_hash *h; ++ struct hlist_nulls_node *n; ++ struct nf_conn *ct; ++ struct ct_pcpu *pcpu = per_cpu_ptr(net->ct.pcpu_lists, cpu); ++ ++ rcu_read_lock(); ++ spin_lock_bh(&pcpu->lock); ++ ++ hlist_nulls_for_each_entry(h, n, &pcpu->dying, hnnode) { ++ ct = nf_ct_tuplehash_to_ctrack(h); ++ if (nf_ct_rtcache_find(ct) != NULL) { ++ wait = true; ++ break; ++ } ++ } ++ spin_unlock_bh(&pcpu->lock); ++ rcu_read_unlock(); ++ } ++ ++ return wait; ++} ++ ++static void __exit nf_conntrack_rtcache_fini(void) ++{ ++ struct net *net; ++ int count = 0; ++ ++ synchronize_net(); ++ ++ unregister_netdevice_notifier(&nf_rtcache_notifier); ++ ++ rtnl_lock(); ++ ++ /* zap all conntracks with rtcache extension */ ++ for_each_net(net) ++ nf_ct_iterate_cleanup_net(net, nf_rtcache_ext_remove, NULL, 0, 0); ++ ++ for_each_net(net) { ++ /* .. and make sure they're gone from dying list, too */ ++ while (nf_conntrack_rtcache_wait_for_dying(net)) { ++ msleep(200); ++ WARN_ONCE(++count > 25, "Waiting for all rtcache conntracks to go away\n"); ++ } ++ } ++ ++ rtnl_unlock(); ++ synchronize_net(); ++ nf_ct_extend_unregister(&rtcache_extend); ++} ++module_init(nf_conntrack_rtcache_init); ++module_exit(nf_conntrack_rtcache_fini); ++ ++MODULE_LICENSE("GPL"); ++MODULE_AUTHOR("Florian Westphal <fw@strlen.de>"); ++MODULE_DESCRIPTION("Conntrack route cache extension"); diff --git a/target/linux/generic/backport-4.19/025-tcp-allow-drivers-to-tweak-TSQ-logic.patch b/target/linux/generic/backport-4.19/025-tcp-allow-drivers-to-tweak-TSQ-logic.patch new file mode 100644 index 0000000000..d9215505ee --- /dev/null +++ b/target/linux/generic/backport-4.19/025-tcp-allow-drivers-to-tweak-TSQ-logic.patch @@ -0,0 +1,85 @@ +From: Eric Dumazet <edumazet@google.com> +Date: Sat, 11 Nov 2017 15:54:12 -0800 +Subject: [PATCH] tcp: allow drivers to tweak TSQ logic +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +I had many reports that TSQ logic breaks wifi aggregation. + +Current logic is to allow up to 1 ms of bytes to be queued into qdisc +and drivers queues. + +But Wifi aggregation needs a bigger budget to allow bigger rates to +be discovered by various TCP Congestion Controls algorithms. + +This patch adds an extra socket field, allowing wifi drivers to select +another log scale to derive TCP Small Queue credit from current pacing +rate. + +Initial value is 10, meaning that this patch does not change current +behavior. + +We expect wifi drivers to set this field to smaller values (tests have +been done with values from 6 to 9) + +They would have to use following template : + +if (skb->sk && skb->sk->sk_pacing_shift != MY_PACING_SHIFT) + skb->sk->sk_pacing_shift = MY_PACING_SHIFT; + +Ref: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1670041 +Signed-off-by: Eric Dumazet <edumazet@google.com> +Cc: Johannes Berg <johannes.berg@intel.com> +Cc: Toke Høiland-Jørgensen <toke@toke.dk> +Cc: Kir Kolyshkin <kir@openvz.org> +--- +--- a/include/net/sock.h ++++ b/include/net/sock.h +@@ -267,6 +267,7 @@ struct sock_common { + * @sk_gso_type: GSO type (e.g. %SKB_GSO_TCPV4) + * @sk_gso_max_size: Maximum GSO segment size to build + * @sk_gso_max_segs: Maximum number of GSO segments ++ * @sk_pacing_shift: scaling factor for TCP Small Queues + * @sk_lingertime: %SO_LINGER l_linger setting + * @sk_backlog: always used with the per-socket spinlock held + * @sk_callback_lock: used with the callbacks in the end of this struct +@@ -445,6 +446,8 @@ struct sock { + sk_type : 16; + #define SK_PROTOCOL_MAX U8_MAX + u16 sk_gso_max_segs; ++#define sk_pacing_shift sk_pacing_shift /* for backport checks */ ++ u8 sk_pacing_shift; + unsigned long sk_lingertime; + struct proto *sk_prot_creator; + rwlock_t sk_callback_lock; +--- a/net/core/sock.c ++++ b/net/core/sock.c +@@ -2739,6 +2739,7 @@ void sock_init_data(struct socket *sock, + + sk->sk_max_pacing_rate = ~0U; + sk->sk_pacing_rate = ~0U; ++ sk->sk_pacing_shift = 10; + sk->sk_incoming_cpu = -1; + /* + * Before updating sk_refcnt, we must commit prior changes to memory +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -1683,7 +1683,7 @@ u32 tcp_tso_autosize(const struct sock * + { + u32 bytes, segs; + +- bytes = min(sk->sk_pacing_rate >> 10, ++ bytes = min(sk->sk_pacing_rate >> sk->sk_pacing_shift, + sk->sk_gso_max_size - 1 - MAX_TCP_HEADER); + + /* Goal is to send at least one packet per ms, +@@ -2184,7 +2184,7 @@ static bool tcp_small_queue_check(struct + { + unsigned int limit; + +- limit = max(2 * skb->truesize, sk->sk_pacing_rate >> 10); ++ limit = max(2 * skb->truesize, sk->sk_pacing_rate >> sk->sk_pacing_shift); + limit = min_t(u32, limit, sysctl_tcp_limit_output_bytes); + limit <<= factor; + diff --git a/target/linux/generic/backport-4.19/030-USB-serial-option-fix-dwm-158-3g-modem-interface.patch b/target/linux/generic/backport-4.19/030-USB-serial-option-fix-dwm-158-3g-modem-interface.patch new file mode 100644 index 0000000000..4201ab1744 --- /dev/null +++ b/target/linux/generic/backport-4.19/030-USB-serial-option-fix-dwm-158-3g-modem-interface.patch @@ -0,0 +1,42 @@ +From 4d304a6fe93538ce356b4593dc43476b50c023e7 Mon Sep 17 00:00:00 2001 +From: Giuseppe Lippolis <giu.lippolis@gmail.com> +Date: Mon, 23 Apr 2018 09:03:06 +0200 +Subject: USB: serial: option: blacklist unused dwm-158 interfaces + +The dwm-158 interface 4 and 5 doesn't answer to the AT commands +and doesn't appears a option interface. +Tested on openwrt distribution (kernel 4.14 using the old blacklist +definitions). + +Lars Melin also writes: + + Blacklisting interface 4 and 5 is correct because: + + MI_00 D-Link Mobile Broadband Device (cdc_ether) + MI_02 D-Link HSPA+DataCard Diagnostics Interface (also ppp modem) + MI_03 D-Link HSPA+DataCard NMEA Device + MI_04 D-Link HSPA+DataCard Speech Port + MI_05 D-Link HSPA+DataCard Debug Port + MI_06 USB Mass Storage Device + +Signed-off-by: Giuseppe Lippolis <giu.lippolis@gmail.com> +[ johan: add Lars's comment on the interface layout and reword summary ] +Cc: Lars Melin <larsm17@gmail.com> +Cc: Dan Williams <dcbw@redhat.com> +Signed-off-by: Johan Hovold <johan@kernel.org> +--- + drivers/usb/serial/option.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1927,7 +1927,8 @@ static const struct usb_device_id option + { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7d01, 0xff) }, /* D-Link DWM-156 (variant) */ + { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7d02, 0xff) }, + { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7d03, 0xff) }, +- { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7d04, 0xff) }, /* D-Link DWM-158 */ ++ { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7d04, 0xff), /* D-Link DWM-158 */ ++ .driver_info = RSVD(4) | RSVD(5) }, + { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7d0e, 0xff) }, /* D-Link DWM-157 C1 */ + { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e19, 0xff), /* D-Link DWM-221 B1 */ + .driver_info = RSVD(4) }, diff --git a/target/linux/generic/backport-4.19/030-v4.17-0001-usb-dwc2-add-support-for-host-mode-external-vbus-sup.patch b/target/linux/generic/backport-4.19/030-v4.17-0001-usb-dwc2-add-support-for-host-mode-external-vbus-sup.patch new file mode 100644 index 0000000000..a17844f5e6 --- /dev/null +++ b/target/linux/generic/backport-4.19/030-v4.17-0001-usb-dwc2-add-support-for-host-mode-external-vbus-sup.patch @@ -0,0 +1,109 @@ +From 531ef5ebea96394ddb7f554d4d88e017dde30a59 Mon Sep 17 00:00:00 2001 +From: Amelie Delaunay <amelie.delaunay@st.com> +Date: Tue, 13 Feb 2018 09:28:12 +0100 +Subject: [PATCH] usb: dwc2: add support for host mode external vbus supply + +This patch adds a way to enable an external vbus supply in host mode, +when dwc2 drvvbus signal is not used. + +This patch is very similar to the one done in U-Boot dwc2 driver [1]. It +also adds dynamic vbus supply management depending on the role and state +of the core. + +[1] https://lists.denx.de/pipermail/u-boot/2017-March/283434.html + +Signed-off-by: Amelie Delaunay <amelie.delaunay@st.com> +Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com> +--- + drivers/usb/dwc2/core.h | 2 ++ + drivers/usb/dwc2/hcd.c | 26 ++++++++++++++++++++++++++ + 2 files changed, 28 insertions(+) + +--- a/drivers/usb/dwc2/core.h ++++ b/drivers/usb/dwc2/core.h +@@ -777,6 +777,7 @@ struct dwc2_hregs_backup { + * @plat: The platform specific configuration data. This can be + * removed once all SoCs support usb transceiver. + * @supplies: Definition of USB power supplies ++ * @vbus_supply: Regulator supplying vbus. + * @phyif: PHY interface width + * @lock: Spinlock that protects all the driver data structures + * @priv: Stores a pointer to the struct usb_hcd +@@ -914,6 +915,7 @@ struct dwc2_hsotg { + struct usb_phy *uphy; + struct dwc2_hsotg_plat *plat; + struct regulator_bulk_data supplies[DWC2_NUM_SUPPLIES]; ++ struct regulator *vbus_supply; + u32 phyif; + + spinlock_t lock; +--- a/drivers/usb/dwc2/hcd.c ++++ b/drivers/usb/dwc2/hcd.c +@@ -359,6 +359,23 @@ static void dwc2_gusbcfg_init(struct dwc + dwc2_writel(usbcfg, hsotg->regs + GUSBCFG); + } + ++static int dwc2_vbus_supply_init(struct dwc2_hsotg *hsotg) ++{ ++ hsotg->vbus_supply = devm_regulator_get_optional(hsotg->dev, "vbus"); ++ if (IS_ERR(hsotg->vbus_supply)) ++ return 0; ++ ++ return regulator_enable(hsotg->vbus_supply); ++} ++ ++static int dwc2_vbus_supply_exit(struct dwc2_hsotg *hsotg) ++{ ++ if (hsotg->vbus_supply) ++ return regulator_disable(hsotg->vbus_supply); ++ ++ return 0; ++} ++ + /** + * dwc2_enable_host_interrupts() - Enables the Host mode interrupts + * +@@ -3342,6 +3359,7 @@ static void dwc2_conn_id_status_change(s + + /* B-Device connector (Device Mode) */ + if (gotgctl & GOTGCTL_CONID_B) { ++ dwc2_vbus_supply_exit(hsotg); + /* Wait for switch to device mode */ + dev_dbg(hsotg->dev, "connId B\n"); + if (hsotg->bus_suspended) { +@@ -4448,6 +4466,9 @@ static int _dwc2_hcd_start(struct usb_hc + } + + spin_unlock_irqrestore(&hsotg->lock, flags); ++ ++ dwc2_vbus_supply_init(hsotg); ++ + return 0; + } + +@@ -4475,6 +4496,8 @@ static void _dwc2_hcd_stop(struct usb_hc + clear_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags); + spin_unlock_irqrestore(&hsotg->lock, flags); + ++ dwc2_vbus_supply_exit(hsotg); ++ + usleep_range(1000, 3000); + } + +@@ -4511,6 +4534,7 @@ static int _dwc2_hcd_suspend(struct usb_ + hprt0 |= HPRT0_SUSP; + hprt0 &= ~HPRT0_PWR; + dwc2_writel(hprt0, hsotg->regs + HPRT0); ++ dwc2_vbus_supply_exit(hsotg); + } + + /* Enter hibernation */ +@@ -4591,6 +4615,8 @@ static int _dwc2_hcd_resume(struct usb_h + spin_unlock_irqrestore(&hsotg->lock, flags); + dwc2_port_resume(hsotg); + } else { ++ dwc2_vbus_supply_init(hsotg); ++ + /* Wait for controller to correctly update D+/D- level */ + usleep_range(3000, 5000); + diff --git a/target/linux/generic/backport-4.19/030-v4.17-0002-usb-dwc2-dwc2_vbus_supply_init-fix-error-check.patch b/target/linux/generic/backport-4.19/030-v4.17-0002-usb-dwc2-dwc2_vbus_supply_init-fix-error-check.patch new file mode 100644 index 0000000000..59ab805cf6 --- /dev/null +++ b/target/linux/generic/backport-4.19/030-v4.17-0002-usb-dwc2-dwc2_vbus_supply_init-fix-error-check.patch @@ -0,0 +1,55 @@ +From 438fea2a6325933868aebc20279e2669c9a21207 Mon Sep 17 00:00:00 2001 +From: Tomeu Vizoso <tomeu.vizoso@collabora.com> +Date: Mon, 26 Mar 2018 11:00:01 +0200 +Subject: [PATCH] usb: dwc2: dwc2_vbus_supply_init: fix error check + +devm_regulator_get_optional returns -ENODEV if the regulator isn't +there, so if that's the case we have to make sure not to leave -ENODEV +in the regulator pointer. + +Also, make sure we return 0 in that case, but correctly propagate any +other errors. Also propagate the error from _dwc2_hcd_start. + +Fixes: 531ef5ebea96 ("usb: dwc2: add support for host mode external vbus supply") +Cc: Amelie Delaunay <amelie.delaunay@st.com> +Reviewed-by: Amelie Delaunay <amelie.delaunay@st.com> +Reviewed-by: Heiko Stuebner <heiko@sntech.de> +Reviewed-by: Grigor Tovmasyan <tovmasya@synopsys.com> +Tested-by: Heiko Stuebner <heiko@sntech.de> +Acked-by: Minas Harutyunyan <hminas@synopsys.com> +Signed-off-by: Tomeu Vizoso <tomeu.vizoso@collabora.com> +Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com> +--- + drivers/usb/dwc2/hcd.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +--- a/drivers/usb/dwc2/hcd.c ++++ b/drivers/usb/dwc2/hcd.c +@@ -361,9 +361,14 @@ static void dwc2_gusbcfg_init(struct dwc + + static int dwc2_vbus_supply_init(struct dwc2_hsotg *hsotg) + { ++ int ret; ++ + hsotg->vbus_supply = devm_regulator_get_optional(hsotg->dev, "vbus"); +- if (IS_ERR(hsotg->vbus_supply)) +- return 0; ++ if (IS_ERR(hsotg->vbus_supply)) { ++ ret = PTR_ERR(hsotg->vbus_supply); ++ hsotg->vbus_supply = NULL; ++ return ret == -ENODEV ? 0 : ret; ++ } + + return regulator_enable(hsotg->vbus_supply); + } +@@ -4467,9 +4472,7 @@ static int _dwc2_hcd_start(struct usb_hc + + spin_unlock_irqrestore(&hsotg->lock, flags); + +- dwc2_vbus_supply_init(hsotg); +- +- return 0; ++ return dwc2_vbus_supply_init(hsotg); + } + + /* diff --git a/target/linux/generic/backport-4.19/040-v4.17-0001-mtd-move-code-adding-master-MTD-out-of-mtd_add_devic.patch b/target/linux/generic/backport-4.19/040-v4.17-0001-mtd-move-code-adding-master-MTD-out-of-mtd_add_devic.patch new file mode 100644 index 0000000000..df6429776f --- /dev/null +++ b/target/linux/generic/backport-4.19/040-v4.17-0001-mtd-move-code-adding-master-MTD-out-of-mtd_add_devic.patch @@ -0,0 +1,74 @@ +From 2c77c57d22adb05b21cdb333a0c42bdfa0e19835 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl> +Date: Tue, 16 Jan 2018 16:45:41 +0100 +Subject: [PATCH] mtd: move code adding master MTD out of + mtd_add_device_partitions() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +This change is a small cleanup of mtd_device_parse_register(). When +using MTD_PARTITIONED_MASTER it makes sure a master MTD is registered +before dealing with partitions. The advantage of this is not mixing +code handling master MTD with code handling partitions. + +This commit doesn't change any behavior except from a slightly different +failure code path. The new code may need to call del_mtd_device when +something goes wrong. + +Signed-off-by: Rafał Miłecki <rafal@milecki.pl> +Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com> +--- + drivers/mtd/mtdcore.c | 25 +++++++++++++------------ + 1 file changed, 13 insertions(+), 12 deletions(-) + +--- a/drivers/mtd/mtdcore.c ++++ b/drivers/mtd/mtdcore.c +@@ -641,20 +641,12 @@ static int mtd_add_device_partitions(str + { + const struct mtd_partition *real_parts = parts->parts; + int nbparts = parts->nr_parts; +- int ret; + +- if (nbparts == 0 || IS_ENABLED(CONFIG_MTD_PARTITIONED_MASTER)) { +- ret = add_mtd_device(mtd); +- if (ret) +- return ret; +- } ++ if (!nbparts && !device_is_registered(&mtd->dev)) ++ return add_mtd_device(mtd); + +- if (nbparts > 0) { +- ret = add_mtd_partitions(mtd, real_parts, nbparts); +- if (ret && IS_ENABLED(CONFIG_MTD_PARTITIONED_MASTER)) +- del_mtd_device(mtd); +- return ret; +- } ++ if (nbparts > 0) ++ return add_mtd_partitions(mtd, real_parts, nbparts); + + return 0; + } +@@ -714,6 +706,12 @@ int mtd_device_parse_register(struct mtd + + mtd_set_dev_defaults(mtd); + ++ if (IS_ENABLED(CONFIG_MTD_PARTITIONED_MASTER)) { ++ ret = add_mtd_device(mtd); ++ if (ret) ++ return ret; ++ } ++ + memset(&parsed, 0, sizeof(parsed)); + + ret = parse_mtd_partitions(mtd, types, &parsed, parser_data); +@@ -753,6 +751,9 @@ int mtd_device_parse_register(struct mtd + out: + /* Cleanup any parsed partitions */ + mtd_part_parser_cleanup(&parsed); ++ if (ret && device_is_registered(&mtd->dev)) ++ del_mtd_device(mtd); ++ + return ret; + } + EXPORT_SYMBOL_GPL(mtd_device_parse_register); diff --git a/target/linux/generic/backport-4.19/040-v4.17-0002-mtd-get-rid-of-the-mtd_add_device_partitions.patch b/target/linux/generic/backport-4.19/040-v4.17-0002-mtd-get-rid-of-the-mtd_add_device_partitions.patch new file mode 100644 index 0000000000..1042e674c3 --- /dev/null +++ b/target/linux/generic/backport-4.19/040-v4.17-0002-mtd-get-rid-of-the-mtd_add_device_partitions.patch @@ -0,0 +1,93 @@ +From 0dbe4ea78d69756efeb0bba0764f6bd4a9ee9567 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl> +Date: Tue, 16 Jan 2018 16:45:42 +0100 +Subject: [PATCH] mtd: get rid of the mtd_add_device_partitions() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +This simplifies code a bit by: +1) Avoiding an extra (tiny) function +2) Checking for amount of parsed (found) partitions just once +3) Avoiding clearing/filling struct mtd_partitions manually + +With this commit proper functions are called directly from the +mtd_device_parse_register(). It doesn't need to use minor tricks like +memsetting struct to 0 to trigger an expected +mtd_add_device_partitions() behavior. + +Signed-off-by: Rafał Miłecki <rafal@milecki.pl> +Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com> +--- + drivers/mtd/mtdcore.c | 43 ++++++++++++------------------------------- + 1 file changed, 12 insertions(+), 31 deletions(-) + +--- a/drivers/mtd/mtdcore.c ++++ b/drivers/mtd/mtdcore.c +@@ -636,21 +636,6 @@ out_error: + return ret; + } + +-static int mtd_add_device_partitions(struct mtd_info *mtd, +- struct mtd_partitions *parts) +-{ +- const struct mtd_partition *real_parts = parts->parts; +- int nbparts = parts->nr_parts; +- +- if (!nbparts && !device_is_registered(&mtd->dev)) +- return add_mtd_device(mtd); +- +- if (nbparts > 0) +- return add_mtd_partitions(mtd, real_parts, nbparts); +- +- return 0; +-} +- + /* + * Set a few defaults based on the parent devices, if not provided by the + * driver +@@ -701,7 +686,7 @@ int mtd_device_parse_register(struct mtd + const struct mtd_partition *parts, + int nr_parts) + { +- struct mtd_partitions parsed; ++ struct mtd_partitions parsed = { }; + int ret; + + mtd_set_dev_defaults(mtd); +@@ -712,24 +697,20 @@ int mtd_device_parse_register(struct mtd + return ret; + } + +- memset(&parsed, 0, sizeof(parsed)); +- ++ /* Prefer parsed partitions over driver-provided fallback */ + ret = parse_mtd_partitions(mtd, types, &parsed, parser_data); +- if ((ret < 0 || parsed.nr_parts == 0) && parts && nr_parts) { +- /* Fall back to driver-provided partitions */ +- parsed = (struct mtd_partitions){ +- .parts = parts, +- .nr_parts = nr_parts, +- }; +- } else if (ret < 0) { +- /* Didn't come up with parsed OR fallback partitions */ +- pr_info("mtd: failed to find partitions; one or more parsers reports errors (%d)\n", +- ret); +- /* Don't abort on errors; we can still use unpartitioned MTD */ +- memset(&parsed, 0, sizeof(parsed)); ++ if (!ret && parsed.nr_parts) { ++ parts = parsed.parts; ++ nr_parts = parsed.nr_parts; + } + +- ret = mtd_add_device_partitions(mtd, &parsed); ++ if (nr_parts) ++ ret = add_mtd_partitions(mtd, parts, nr_parts); ++ else if (!device_is_registered(&mtd->dev)) ++ ret = add_mtd_device(mtd); ++ else ++ ret = 0; ++ + if (ret) + goto out; + diff --git a/target/linux/generic/backport-4.19/041-v4.17-0001-mtd-partitions-add-of_match_table-parser-matching-fo.patch b/target/linux/generic/backport-4.19/041-v4.17-0001-mtd-partitions-add-of_match_table-parser-matching-fo.patch new file mode 100644 index 0000000000..bd39a2625e --- /dev/null +++ b/target/linux/generic/backport-4.19/041-v4.17-0001-mtd-partitions-add-of_match_table-parser-matching-fo.patch @@ -0,0 +1,200 @@ +From 5b644aa012f67fd211138a067b9f351f30bdcc60 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl> +Date: Wed, 14 Mar 2018 13:10:42 +0100 +Subject: [PATCH] mtd: partitions: add of_match_table parser matching for the + "ofpart" type +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +In order to properly support compatibility strings as described in the +bindings/mtd/partition.txt "ofpart" type should be treated as an +indication for looking into OF. MTD should check "compatible" property +and search for a matching parser rather than blindly trying the one +supporting "fixed-partitions". + +It also means that existing "fixed-partitions" parser should get renamed +to use a more meaningful name. + +This commit achievies that aim by introducing a new mtd_part_of_parse(). +It works by looking for a matching parser for every string in the +"compatibility" property (starting with the most specific one). + +Please note that driver-specified parsers still take a precedence. It's +assumed that driver providing a parser type has a good reason for that +(e.g. having platform data with device-specific info). Also doing +otherwise could break existing setups. The same applies to using default +parsers (including "cmdlinepart") as some overwrite DT data with cmdline +argument. + +Partition parsers can now provide an of_match_table to enable +flash<-->parser matching via device tree as documented in the +mtd/partition.txt. + +This support is currently limited to built-in parsers as it uses +request_module() and friends. This should be sufficient for most cases +though as compiling parsers as modules isn't a common choice. + +Signed-off-by: Brian Norris <computersforpeace@gmail.com> +Signed-off-by: Rafał Miłecki <rafal@milecki.pl> +Tested-by: Peter Rosin <peda@axentia.se> +Reviewed-by: Richard Weinberger <richard@nod.at> +Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com> +--- + drivers/mtd/mtdpart.c | 116 +++++++++++++++++++++++++++++++++++++---- + include/linux/mtd/partitions.h | 1 + + 2 files changed, 108 insertions(+), 9 deletions(-) + +--- a/drivers/mtd/mtdpart.c ++++ b/drivers/mtd/mtdpart.c +@@ -30,6 +30,7 @@ + #include <linux/mtd/mtd.h> + #include <linux/mtd/partitions.h> + #include <linux/err.h> ++#include <linux/of.h> + + #include "mtdcore.h" + +@@ -894,6 +895,92 @@ static int mtd_part_do_parse(struct mtd_ + } + + /** ++ * mtd_part_get_compatible_parser - find MTD parser by a compatible string ++ * ++ * @compat: compatible string describing partitions in a device tree ++ * ++ * MTD parsers can specify supported partitions by providing a table of ++ * compatibility strings. This function finds a parser that advertises support ++ * for a passed value of "compatible". ++ */ ++static struct mtd_part_parser *mtd_part_get_compatible_parser(const char *compat) ++{ ++ struct mtd_part_parser *p, *ret = NULL; ++ ++ spin_lock(&part_parser_lock); ++ ++ list_for_each_entry(p, &part_parsers, list) { ++ const struct of_device_id *matches; ++ ++ matches = p->of_match_table; ++ if (!matches) ++ continue; ++ ++ for (; matches->compatible[0]; matches++) { ++ if (!strcmp(matches->compatible, compat) && ++ try_module_get(p->owner)) { ++ ret = p; ++ break; ++ } ++ } ++ ++ if (ret) ++ break; ++ } ++ ++ spin_unlock(&part_parser_lock); ++ ++ return ret; ++} ++ ++static int mtd_part_of_parse(struct mtd_info *master, ++ struct mtd_partitions *pparts) ++{ ++ struct mtd_part_parser *parser; ++ struct device_node *np; ++ struct property *prop; ++ const char *compat; ++ const char *fixed = "ofpart"; ++ int ret, err = 0; ++ ++ np = of_get_child_by_name(mtd_get_of_node(master), "partitions"); ++ of_property_for_each_string(np, "compatible", prop, compat) { ++ parser = mtd_part_get_compatible_parser(compat); ++ if (!parser) ++ continue; ++ ret = mtd_part_do_parse(parser, master, pparts, NULL); ++ if (ret > 0) { ++ of_node_put(np); ++ return ret; ++ } ++ mtd_part_parser_put(parser); ++ if (ret < 0 && !err) ++ err = ret; ++ } ++ of_node_put(np); ++ ++ /* ++ * For backward compatibility we have to try the "ofpart" ++ * parser. It supports old DT format with partitions specified as a ++ * direct subnodes of a flash device DT node without any compatibility ++ * specified we could match. ++ */ ++ parser = mtd_part_parser_get(fixed); ++ if (!parser && !request_module("%s", fixed)) ++ parser = mtd_part_parser_get(fixed); ++ if (parser) { ++ ret = mtd_part_do_parse(parser, master, pparts, NULL); ++ if (ret > 0) ++ return ret; ++ mtd_part_parser_put(parser); ++ if (ret < 0 && !err) ++ err = ret; ++ } ++ ++ return err; ++} ++ ++/** + * parse_mtd_partitions - parse MTD partitions + * @master: the master partition (describes whole MTD device) + * @types: names of partition parsers to try or %NULL +@@ -925,19 +1012,30 @@ int parse_mtd_partitions(struct mtd_info + types = default_mtd_part_types; + + for ( ; *types; types++) { +- pr_debug("%s: parsing partitions %s\n", master->name, *types); +- parser = mtd_part_parser_get(*types); +- if (!parser && !request_module("%s", *types)) ++ /* ++ * ofpart is a special type that means OF partitioning info ++ * should be used. It requires a bit different logic so it is ++ * handled in a separated function. ++ */ ++ if (!strcmp(*types, "ofpart")) { ++ ret = mtd_part_of_parse(master, pparts); ++ } else { ++ pr_debug("%s: parsing partitions %s\n", master->name, ++ *types); + parser = mtd_part_parser_get(*types); +- pr_debug("%s: got parser %s\n", master->name, +- parser ? parser->name : NULL); +- if (!parser) +- continue; +- ret = mtd_part_do_parse(parser, master, pparts, data); ++ if (!parser && !request_module("%s", *types)) ++ parser = mtd_part_parser_get(*types); ++ pr_debug("%s: got parser %s\n", master->name, ++ parser ? parser->name : NULL); ++ if (!parser) ++ continue; ++ ret = mtd_part_do_parse(parser, master, pparts, data); ++ if (ret <= 0) ++ mtd_part_parser_put(parser); ++ } + /* Found partitions! */ + if (ret > 0) + return 0; +- mtd_part_parser_put(parser); + /* + * Stash the first error we see; only report it if no parser + * succeeds +--- a/include/linux/mtd/partitions.h ++++ b/include/linux/mtd/partitions.h +@@ -77,6 +77,7 @@ struct mtd_part_parser { + struct list_head list; + struct module *owner; + const char *name; ++ const struct of_device_id *of_match_table; + int (*parse_fn)(struct mtd_info *, const struct mtd_partition **, + struct mtd_part_parser_data *); + void (*cleanup)(const struct mtd_partition *pparts, int nr_parts); diff --git a/target/linux/generic/backport-4.19/041-v4.17-0002-mtd-rename-ofpart-parser-to-fixed-partitions-as-it-f.patch b/target/linux/generic/backport-4.19/041-v4.17-0002-mtd-rename-ofpart-parser-to-fixed-partitions-as-it-f.patch new file mode 100644 index 0000000000..66b67d7676 --- /dev/null +++ b/target/linux/generic/backport-4.19/041-v4.17-0002-mtd-rename-ofpart-parser-to-fixed-partitions-as-it-f.patch @@ -0,0 +1,74 @@ +From c0faf43482e7f7dfb6d61847cb93d17748560b24 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl> +Date: Wed, 14 Mar 2018 13:10:43 +0100 +Subject: [PATCH] mtd: rename "ofpart" parser to "fixed-partitions" as it fits + it better +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Type "ofpart" means that OF should be used to get partitioning info and +this driver supports "fixed-partitions" binding only. Renaming it should +lead to less confusion especially when parsers for new compatibility +strings start to appear. + +Signed-off-by: Rafał Miłecki <rafal@milecki.pl> +Reviewed-by: Richard Weinberger <richard@nod.at> +Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com> +--- + drivers/mtd/mtdpart.c | 4 ++-- + drivers/mtd/ofpart.c | 11 ++++++----- + 2 files changed, 8 insertions(+), 7 deletions(-) + +--- a/drivers/mtd/mtdpart.c ++++ b/drivers/mtd/mtdpart.c +@@ -940,7 +940,7 @@ static int mtd_part_of_parse(struct mtd_ + struct device_node *np; + struct property *prop; + const char *compat; +- const char *fixed = "ofpart"; ++ const char *fixed = "fixed-partitions"; + int ret, err = 0; + + np = of_get_child_by_name(mtd_get_of_node(master), "partitions"); +@@ -960,7 +960,7 @@ static int mtd_part_of_parse(struct mtd_ + of_node_put(np); + + /* +- * For backward compatibility we have to try the "ofpart" ++ * For backward compatibility we have to try the "fixed-partitions" + * parser. It supports old DT format with partitions specified as a + * direct subnodes of a flash device DT node without any compatibility + * specified we could match. +--- a/drivers/mtd/ofpart.c ++++ b/drivers/mtd/ofpart.c +@@ -25,9 +25,9 @@ static bool node_has_compatible(struct d + return of_get_property(pp, "compatible", NULL); + } + +-static int parse_ofpart_partitions(struct mtd_info *master, +- const struct mtd_partition **pparts, +- struct mtd_part_parser_data *data) ++static int parse_fixed_partitions(struct mtd_info *master, ++ const struct mtd_partition **pparts, ++ struct mtd_part_parser_data *data) + { + struct mtd_partition *parts; + struct device_node *mtd_node; +@@ -141,8 +141,8 @@ ofpart_none: + } + + static struct mtd_part_parser ofpart_parser = { +- .parse_fn = parse_ofpart_partitions, +- .name = "ofpart", ++ .parse_fn = parse_fixed_partitions, ++ .name = "fixed-partitions", + }; + + static int parse_ofoldpart_partitions(struct mtd_info *master, +@@ -229,4 +229,5 @@ MODULE_AUTHOR("Vitaly Wool, David Gibson + * with the same name. Since we provide the ofoldpart parser, we should have + * the corresponding alias. + */ ++MODULE_ALIAS("fixed-partitions"); + MODULE_ALIAS("ofoldpart"); diff --git a/target/linux/generic/backport-4.19/041-v4.17-0003-mtd-ofpart-add-of_match_table-with-fixed-partitions.patch b/target/linux/generic/backport-4.19/041-v4.17-0003-mtd-ofpart-add-of_match_table-with-fixed-partitions.patch new file mode 100644 index 0000000000..d6958c3eac --- /dev/null +++ b/target/linux/generic/backport-4.19/041-v4.17-0003-mtd-ofpart-add-of_match_table-with-fixed-partitions.patch @@ -0,0 +1,44 @@ +From 97b0c7c0df3efd7048ed39d7e2dee34cafd55887 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl> +Date: Wed, 14 Mar 2018 13:10:44 +0100 +Subject: [PATCH] mtd: ofpart: add of_match_table with "fixed-partitions" +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +This allows using this parser with any flash driver that takes care of +setting of_node (using mtd_set_of_node helper) correctly. Up to now +support for "fixed-partitions" DT compatibility string was working only +with flash drivers that were specifying "ofpart" (manually or by letting +mtd use the default set of parsers). + +This matches existing bindings documentation. + +Signed-off-by: Rafał Miłecki <rafal@milecki.pl> +Reviewed-by: Brian Norris <computersforpeace@gmail.com> +Tested-by: Brian Norris <computersforpeace@gmail.com> +Reviewed-by: Richard Weinberger <richard@nod.at> +Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com> +--- + drivers/mtd/ofpart.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/mtd/ofpart.c ++++ b/drivers/mtd/ofpart.c +@@ -140,9 +140,16 @@ ofpart_none: + return ret; + } + ++static const struct of_device_id parse_ofpart_match_table[] = { ++ { .compatible = "fixed-partitions" }, ++ {}, ++}; ++MODULE_DEVICE_TABLE(of, parse_ofpart_match_table); ++ + static struct mtd_part_parser ofpart_parser = { + .parse_fn = parse_fixed_partitions, + .name = "fixed-partitions", ++ .of_match_table = parse_ofpart_match_table, + }; + + static int parse_ofoldpart_partitions(struct mtd_info *master, diff --git a/target/linux/generic/backport-4.19/042-v4.18-0001-mtd-move-code-adding-registering-partitions-to-the-p.patch b/target/linux/generic/backport-4.19/042-v4.18-0001-mtd-move-code-adding-registering-partitions-to-the-p.patch new file mode 100644 index 0000000000..83077431b8 --- /dev/null +++ b/target/linux/generic/backport-4.19/042-v4.18-0001-mtd-move-code-adding-registering-partitions-to-the-p.patch @@ -0,0 +1,168 @@ +From 5ac67ce36cfe38b4c104a42ce52c5c8d526f1c95 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl> +Date: Tue, 27 Mar 2018 22:35:41 +0200 +Subject: [PATCH] mtd: move code adding (registering) partitions to the + parse_mtd_partitions() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +This commit slightly simplifies the code. Every parse_mtd_partitions() +caller (out of two existing ones) had to add partitions & cleanup parser +on its own. This moves that responsibility into the function. + +That change also allows dropping struct mtd_partitions argument. + +There is one minor behavior change caused by this cleanup. If +parse_mtd_partitions() fails to add partitions (add_mtd_partitions() +return an error) then mtd_device_parse_register() will still try to +add (register) fallback partitions. It's a real corner case affecting +one of uncommon error paths and shouldn't cause any harm. + +Signed-off-by: Rafał Miłecki <rafal@milecki.pl> +Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com> +--- + drivers/mtd/mtdcore.c | 14 ++++---------- + drivers/mtd/mtdcore.h | 1 - + drivers/mtd/mtdpart.c | 44 ++++++++++++++++---------------------------- + 3 files changed, 20 insertions(+), 39 deletions(-) + +--- a/drivers/mtd/mtdcore.c ++++ b/drivers/mtd/mtdcore.c +@@ -686,7 +686,6 @@ int mtd_device_parse_register(struct mtd + const struct mtd_partition *parts, + int nr_parts) + { +- struct mtd_partitions parsed = { }; + int ret; + + mtd_set_dev_defaults(mtd); +@@ -698,13 +697,10 @@ int mtd_device_parse_register(struct mtd + } + + /* Prefer parsed partitions over driver-provided fallback */ +- ret = parse_mtd_partitions(mtd, types, &parsed, parser_data); +- if (!ret && parsed.nr_parts) { +- parts = parsed.parts; +- nr_parts = parsed.nr_parts; +- } +- +- if (nr_parts) ++ ret = parse_mtd_partitions(mtd, types, parser_data); ++ if (ret > 0) ++ ret = 0; ++ else if (nr_parts) + ret = add_mtd_partitions(mtd, parts, nr_parts); + else if (!device_is_registered(&mtd->dev)) + ret = add_mtd_device(mtd); +@@ -730,8 +726,6 @@ int mtd_device_parse_register(struct mtd + } + + out: +- /* Cleanup any parsed partitions */ +- mtd_part_parser_cleanup(&parsed); + if (ret && device_is_registered(&mtd->dev)) + del_mtd_device(mtd); + +--- a/drivers/mtd/mtdcore.h ++++ b/drivers/mtd/mtdcore.h +@@ -15,7 +15,6 @@ int del_mtd_partitions(struct mtd_info * + struct mtd_partitions; + + int parse_mtd_partitions(struct mtd_info *master, const char * const *types, +- struct mtd_partitions *pparts, + struct mtd_part_parser_data *data); + + void mtd_part_parser_cleanup(struct mtd_partitions *parts); +--- a/drivers/mtd/mtdpart.c ++++ b/drivers/mtd/mtdpart.c +@@ -383,20 +383,7 @@ static inline void free_partition(struct + */ + static int mtd_parse_part(struct mtd_part *slave, const char *const *types) + { +- struct mtd_partitions parsed; +- int err; +- +- err = parse_mtd_partitions(&slave->mtd, types, &parsed, NULL); +- if (err) +- return err; +- else if (!parsed.nr_parts) +- return -ENOENT; +- +- err = add_mtd_partitions(&slave->mtd, parsed.parts, parsed.nr_parts); +- +- mtd_part_parser_cleanup(&parsed); +- +- return err; ++ return parse_mtd_partitions(&slave->mtd, types, NULL); + } + + static struct mtd_part *allocate_partition(struct mtd_info *parent, +@@ -981,30 +968,27 @@ static int mtd_part_of_parse(struct mtd_ + } + + /** +- * parse_mtd_partitions - parse MTD partitions ++ * parse_mtd_partitions - parse and register MTD partitions ++ * + * @master: the master partition (describes whole MTD device) + * @types: names of partition parsers to try or %NULL +- * @pparts: info about partitions found is returned here + * @data: MTD partition parser-specific data + * +- * This function tries to find partition on MTD device @master. It uses MTD +- * partition parsers, specified in @types. However, if @types is %NULL, then +- * the default list of parsers is used. The default list contains only the ++ * This function tries to find & register partitions on MTD device @master. It ++ * uses MTD partition parsers, specified in @types. However, if @types is %NULL, ++ * then the default list of parsers is used. The default list contains only the + * "cmdlinepart" and "ofpart" parsers ATM. + * Note: If there are more then one parser in @types, the kernel only takes the + * partitions parsed out by the first parser. + * + * This function may return: + * o a negative error code in case of failure +- * o zero otherwise, and @pparts will describe the partitions, number of +- * partitions, and the parser which parsed them. Caller must release +- * resources with mtd_part_parser_cleanup() when finished with the returned +- * data. ++ * o number of found partitions otherwise + */ + int parse_mtd_partitions(struct mtd_info *master, const char *const *types, +- struct mtd_partitions *pparts, + struct mtd_part_parser_data *data) + { ++ struct mtd_partitions pparts = { }; + struct mtd_part_parser *parser; + int ret, err = 0; + +@@ -1018,7 +1002,7 @@ int parse_mtd_partitions(struct mtd_info + * handled in a separated function. + */ + if (!strcmp(*types, "ofpart")) { +- ret = mtd_part_of_parse(master, pparts); ++ ret = mtd_part_of_parse(master, &pparts); + } else { + pr_debug("%s: parsing partitions %s\n", master->name, + *types); +@@ -1029,13 +1013,17 @@ int parse_mtd_partitions(struct mtd_info + parser ? parser->name : NULL); + if (!parser) + continue; +- ret = mtd_part_do_parse(parser, master, pparts, data); ++ ret = mtd_part_do_parse(parser, master, &pparts, data); + if (ret <= 0) + mtd_part_parser_put(parser); + } + /* Found partitions! */ +- if (ret > 0) +- return 0; ++ if (ret > 0) { ++ err = add_mtd_partitions(master, pparts.parts, ++ pparts.nr_parts); ++ mtd_part_parser_cleanup(&pparts); ++ return err ? err : pparts.nr_parts; ++ } + /* + * Stash the first error we see; only report it if no parser + * succeeds diff --git a/target/linux/generic/backport-4.19/043-v4.18-mtd-bcm47xxpart-improve-handling-TRX-partition-size.patch b/target/linux/generic/backport-4.19/043-v4.18-mtd-bcm47xxpart-improve-handling-TRX-partition-size.patch new file mode 100644 index 0000000000..e08f8dad32 --- /dev/null +++ b/target/linux/generic/backport-4.19/043-v4.18-mtd-bcm47xxpart-improve-handling-TRX-partition-size.patch @@ -0,0 +1,70 @@ +From 237ea0d4762cc14d0fc80e80d61f0f08e1050c7f Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl> +Date: Thu, 12 Apr 2018 07:24:52 +0200 +Subject: [PATCH] mtd: bcm47xxpart: improve handling TRX partition size +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +When bcm47xxpart finds a TRX partition (container) it's supposed to jump +to the end of it and keep looking for more partitions. TRX and its +subpartitions are handled by a separate parser. + +The problem with old code was relying on the length specified in a TRX +header. That isn't reliable as TRX is commonly modified to have checksum +cover only non-changing subpartitions. Otherwise modifying e.g. a rootfs +would result in CRC32 mismatch and bootloader refusing to boot a +firmware. + +Fix it by trying better to figure out a real TRX size. We can securely +assume that TRX has to cover all subpartitions and the last one is at +least of a block size in size. Then compare it with a length field. + +This makes code more optimal & reliable thanks to skipping data that +shouldn't be parsed. + +Signed-off-by: Rafał Miłecki <rafal@milecki.pl> +Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com> +--- + drivers/mtd/bcm47xxpart.c | 22 ++++++++++++++++++---- + 1 file changed, 18 insertions(+), 4 deletions(-) + +--- a/drivers/mtd/bcm47xxpart.c ++++ b/drivers/mtd/bcm47xxpart.c +@@ -186,6 +186,8 @@ static int bcm47xxpart_parse(struct mtd_ + /* TRX */ + if (buf[0x000 / 4] == TRX_MAGIC) { + struct trx_header *trx; ++ uint32_t last_subpart; ++ uint32_t trx_size; + + if (trx_num >= ARRAY_SIZE(trx_parts)) + pr_warn("No enough space to store another TRX found at 0x%X\n", +@@ -195,11 +197,23 @@ static int bcm47xxpart_parse(struct mtd_ + bcm47xxpart_add_part(&parts[curr_part++], "firmware", + offset, 0); + +- /* Jump to the end of TRX */ ++ /* ++ * Try to find TRX size. The "length" field isn't fully ++ * reliable as it could be decreased to make CRC32 cover ++ * only part of TRX data. It's commonly used as checksum ++ * can't cover e.g. ever-changing rootfs partition. ++ * Use offsets as helpers for assuming min TRX size. ++ */ + trx = (struct trx_header *)buf; +- offset = roundup(offset + trx->length, blocksize); +- /* Next loop iteration will increase the offset */ +- offset -= blocksize; ++ last_subpart = max3(trx->offset[0], trx->offset[1], ++ trx->offset[2]); ++ trx_size = max(trx->length, last_subpart + blocksize); ++ ++ /* ++ * Skip the TRX data. Decrease offset by block size as ++ * the next loop iteration will increase it. ++ */ ++ offset += roundup(trx_size, blocksize) - blocksize; + continue; + } + diff --git a/target/linux/generic/backport-4.19/044-v4.18-mtd-bcm47xxpart-add-of_match_table-with-a-new-DT-bin.patch b/target/linux/generic/backport-4.19/044-v4.18-mtd-bcm47xxpart-add-of_match_table-with-a-new-DT-bin.patch new file mode 100644 index 0000000000..de0ff1f818 --- /dev/null +++ b/target/linux/generic/backport-4.19/044-v4.18-mtd-bcm47xxpart-add-of_match_table-with-a-new-DT-bin.patch @@ -0,0 +1,39 @@ +From cf589ce71e84d3b8811c65740645af254c5248c0 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl> +Date: Wed, 9 May 2018 10:17:29 +0200 +Subject: [PATCH] mtd: bcm47xxpart: add of_match_table with a new DT binding +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +This allows using bcm47xxpart parser to find partitions on flash +described in DT using the "brcm,bcm947xx-cfe-partitions" compatible +property. It means this parser doesn't have to be explicitly selected by +a flash driver anymore. It can be used e.g. together with a generic +m25p80 / spi-nor if device is just properly described. + +Signed-off-by: Rafał Miłecki <rafal@milecki.pl> +Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com> +--- + drivers/mtd/bcm47xxpart.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/mtd/bcm47xxpart.c ++++ b/drivers/mtd/bcm47xxpart.c +@@ -304,9 +304,16 @@ static int bcm47xxpart_parse(struct mtd_ + return curr_part; + }; + ++static const struct of_device_id bcm47xxpart_of_match_table[] = { ++ { .compatible = "brcm,bcm947xx-cfe-partitions" }, ++ {}, ++}; ++MODULE_DEVICE_TABLE(of, bcm47xxpart_of_match_table); ++ + static struct mtd_part_parser bcm47xxpart_mtd_parser = { + .parse_fn = bcm47xxpart_parse, + .name = "bcm47xxpart", ++ .of_match_table = bcm47xxpart_of_match_table, + }; + module_mtd_part_parser(bcm47xxpart_mtd_parser); + diff --git a/target/linux/generic/backport-4.19/045-v4.19-mtd-parsers-trx-add-of_match_table-with-the-new-DT-b.patch b/target/linux/generic/backport-4.19/045-v4.19-mtd-parsers-trx-add-of_match_table-with-the-new-DT-b.patch new file mode 100644 index 0000000000..5841dd55f3 --- /dev/null +++ b/target/linux/generic/backport-4.19/045-v4.19-mtd-parsers-trx-add-of_match_table-with-the-new-DT-b.patch @@ -0,0 +1,37 @@ +From 98534a58c8a40cdc9e3bcb04d74719fbcedfeb52 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl> +Date: Tue, 26 Jun 2018 00:05:08 +0200 +Subject: [PATCH] mtd: parsers: trx: add of_match_table with the new DT binding +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +This allows using TRX parser to find TRX partitions on flash device +described in DT using a proper binding. It's useful for devices storing +firmware on a separated flash and having rootfs partition in it. + +Signed-off-by: Rafał Miłecki <rafal@milecki.pl> +Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com> +--- + drivers/mtd/parsers/parser_trx.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/mtd/parsers/parser_trx.c ++++ b/drivers/mtd/parsers/parser_trx.c +@@ -116,9 +116,16 @@ static int parser_trx_parse(struct mtd_i + return i; + }; + ++static const struct of_device_id mtd_parser_trx_of_match_table[] = { ++ { .compatible = "brcm,trx" }, ++ {}, ++}; ++MODULE_DEVICE_TABLE(of, mtd_parser_trx_of_match_table); ++ + static struct mtd_part_parser mtd_parser_trx = { + .parse_fn = parser_trx_parse, + .name = "trx", ++ .of_match_table = mtd_parser_trx_of_match_table, + }; + module_mtd_part_parser(mtd_parser_trx); + diff --git a/target/linux/generic/backport-4.19/046-v4.19-mtd-partitions-use-DT-info-for-parsing-partitions-wi.patch b/target/linux/generic/backport-4.19/046-v4.19-mtd-partitions-use-DT-info-for-parsing-partitions-wi.patch new file mode 100644 index 0000000000..1bb3563f15 --- /dev/null +++ b/target/linux/generic/backport-4.19/046-v4.19-mtd-partitions-use-DT-info-for-parsing-partitions-wi.patch @@ -0,0 +1,102 @@ +From 76a832254ab05502c9394cc51ded6f0abe0e0bee Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl> +Date: Fri, 13 Jul 2018 16:32:21 +0200 +Subject: [PATCH] mtd: partitions: use DT info for parsing partitions with + "compatible" prop +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +So far only flash devices could be described in DT regarding partitions +parsing. That could be done with "partitions" subnode and a proper +"compatible" string. + +Some devices may use hierarchical (multi-level) layouts and may mix used +layouts (fixed and dynamic). Describing that in DT is done by specifying +"compatible" for DT-represented partition plus optionally more +properties and/or subnodes. + +To support such layouts each DT partition has to be checked for +additional description. + +Please note this implementation will work in parallel with support for +partition type specified for non-DT setups. That already works since +commit 1a0915be1926 ("mtd: partitions: add support for partition +parsers"). + +Signed-off-by: Rafał Miłecki <rafal@milecki.pl> +Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com> +--- + drivers/mtd/mtdpart.c | 33 +++++++++++++-------------------- + 1 file changed, 13 insertions(+), 20 deletions(-) + +--- a/drivers/mtd/mtdpart.c ++++ b/drivers/mtd/mtdpart.c +@@ -370,22 +370,6 @@ static inline void free_partition(struct + kfree(p); + } + +-/** +- * mtd_parse_part - parse MTD partition looking for subpartitions +- * +- * @slave: part that is supposed to be a container and should be parsed +- * @types: NULL-terminated array with names of partition parsers to try +- * +- * Some partitions are kind of containers with extra subpartitions (volumes). +- * There can be various formats of such containers. This function tries to use +- * specified parsers to analyze given partition and registers found +- * subpartitions on success. +- */ +-static int mtd_parse_part(struct mtd_part *slave, const char *const *types) +-{ +- return parse_mtd_partitions(&slave->mtd, types, NULL); +-} +- + static struct mtd_part *allocate_partition(struct mtd_info *parent, + const struct mtd_partition *part, int partno, + uint64_t cur_offset) +@@ -783,8 +767,8 @@ int add_mtd_partitions(struct mtd_info * + + add_mtd_device(&slave->mtd); + mtd_add_partition_attrs(slave); +- if (parts[i].types) +- mtd_parse_part(slave, parts[i].types); ++ /* Look for subpartitions */ ++ parse_mtd_partitions(&slave->mtd, parts[i].types, NULL); + + cur_offset = slave->offset + slave->mtd.size; + } +@@ -860,6 +844,12 @@ static const char * const default_mtd_pa + NULL + }; + ++/* Check DT only when looking for subpartitions. */ ++static const char * const default_subpartition_types[] = { ++ "ofpart", ++ NULL ++}; ++ + static int mtd_part_do_parse(struct mtd_part_parser *parser, + struct mtd_info *master, + struct mtd_partitions *pparts, +@@ -930,7 +920,9 @@ static int mtd_part_of_parse(struct mtd_ + const char *fixed = "fixed-partitions"; + int ret, err = 0; + +- np = of_get_child_by_name(mtd_get_of_node(master), "partitions"); ++ np = mtd_get_of_node(master); ++ if (!mtd_is_partition(master)) ++ np = of_get_child_by_name(np, "partitions"); + of_property_for_each_string(np, "compatible", prop, compat) { + parser = mtd_part_get_compatible_parser(compat); + if (!parser) +@@ -993,7 +985,8 @@ int parse_mtd_partitions(struct mtd_info + int ret, err = 0; + + if (!types) +- types = default_mtd_part_types; ++ types = mtd_is_partition(master) ? default_subpartition_types : ++ default_mtd_part_types; + + for ( ; *types; types++) { + /* diff --git a/target/linux/generic/backport-4.19/047-v4.21-mtd-keep-original-flags-for-every-struct-mtd_info.patch b/target/linux/generic/backport-4.19/047-v4.21-mtd-keep-original-flags-for-every-struct-mtd_info.patch new file mode 100644 index 0000000000..7f90cf946a --- /dev/null +++ b/target/linux/generic/backport-4.19/047-v4.21-mtd-keep-original-flags-for-every-struct-mtd_info.patch @@ -0,0 +1,58 @@ +From 1186af457cc186c5ed01708da71b1ffbdf0a2638 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl> +Date: Tue, 20 Nov 2018 09:55:45 +0100 +Subject: [PATCH] mtd: keep original flags for every struct mtd_info +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +When allocating a new partition mtd subsystem runs internal tests in the +allocate_partition(). They may result in modifying specified flags (e.g. +dropping some /features/ like write access). + +Those constraints don't have to be necessary true for subpartitions. It +may happen parent partition isn't block aligned (effectively disabling +write access) while subpartition may fit blocks nicely. In such case all +checks should be run again (starting with original flags value). + +Signed-off-by: Rafał Miłecki <rafal@milecki.pl> +Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com> +--- + drivers/mtd/mtdcore.c | 2 ++ + drivers/mtd/mtdpart.c | 3 ++- + include/linux/mtd/mtd.h | 1 + + 3 files changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/mtd/mtdcore.c ++++ b/drivers/mtd/mtdcore.c +@@ -650,6 +650,8 @@ static void mtd_set_dev_defaults(struct + } else { + pr_debug("mtd device won't show a device symlink in sysfs\n"); + } ++ ++ mtd->orig_flags = mtd->flags; + } + + /** +--- a/drivers/mtd/mtdpart.c ++++ b/drivers/mtd/mtdpart.c +@@ -394,7 +394,8 @@ static struct mtd_part *allocate_partiti + + /* set up the MTD object for this partition */ + slave->mtd.type = parent->type; +- slave->mtd.flags = parent->flags & ~part->mask_flags; ++ slave->mtd.flags = parent->orig_flags & ~part->mask_flags; ++ slave->mtd.orig_flags = slave->mtd.flags; + slave->mtd.size = part->size; + slave->mtd.writesize = parent->writesize; + slave->mtd.writebufsize = parent->writebufsize; +--- a/include/linux/mtd/mtd.h ++++ b/include/linux/mtd/mtd.h +@@ -218,6 +218,7 @@ struct mtd_debug_info { + struct mtd_info { + u_char type; + uint32_t flags; ++ uint32_t orig_flags; /* Flags as before running mtd checks */ + uint64_t size; // Total size of the MTD + + /* "Major" erase size for the device. Naïve users may take this diff --git a/target/linux/generic/backport-4.19/048-v4.21-mtd-improve-calculating-partition-boundaries-when-ch.patch b/target/linux/generic/backport-4.19/048-v4.21-mtd-improve-calculating-partition-boundaries-when-ch.patch new file mode 100644 index 0000000000..58163e6935 --- /dev/null +++ b/target/linux/generic/backport-4.19/048-v4.21-mtd-improve-calculating-partition-boundaries-when-ch.patch @@ -0,0 +1,55 @@ +From 6750f61a13a0197c40e4a40739117493b15f19e8 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl> +Date: Tue, 20 Nov 2018 10:24:09 +0100 +Subject: [PATCH] mtd: improve calculating partition boundaries when checking + for alignment +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +When checking for alignment mtd should check absolute offsets. It's +important for subpartitions as it doesn't make sense to check their +relative addresses. + +Signed-off-by: Rafał Miłecki <rafal@milecki.pl> +Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com> +--- + drivers/mtd/mtdpart.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +--- a/drivers/mtd/mtdpart.c ++++ b/drivers/mtd/mtdpart.c +@@ -61,6 +61,15 @@ static inline struct mtd_part *mtd_to_pa + return container_of(mtd, struct mtd_part, mtd); + } + ++static u64 part_absolute_offset(struct mtd_info *mtd) ++{ ++ struct mtd_part *part = mtd_to_part(mtd); ++ ++ if (!mtd_is_partition(mtd)) ++ return 0; ++ ++ return part_absolute_offset(part->parent) + part->offset; ++} + + /* + * MTD methods which simply translate the effective address and pass through +@@ -562,7 +571,7 @@ static struct mtd_part *allocate_partiti + if (!(slave->mtd.flags & MTD_NO_ERASE)) + wr_alignment = slave->mtd.erasesize; + +- tmp = slave->offset; ++ tmp = part_absolute_offset(parent) + slave->offset; + remainder = do_div(tmp, wr_alignment); + if ((slave->mtd.flags & MTD_WRITEABLE) && remainder) { + /* Doesn't start on a boundary of major erase size */ +@@ -573,7 +582,7 @@ static struct mtd_part *allocate_partiti + part->name); + } + +- tmp = slave->mtd.size; ++ tmp = part_absolute_offset(parent) + slave->mtd.size; + remainder = do_div(tmp, wr_alignment); + if ((slave->mtd.flags & MTD_WRITEABLE) && remainder) { + slave->mtd.flags &= ~MTD_WRITEABLE; diff --git a/target/linux/generic/backport-4.19/071-v4.15-0001-net-bgmac-enable-master-mode-for-BCM54210E-and-B5021.patch b/target/linux/generic/backport-4.19/071-v4.15-0001-net-bgmac-enable-master-mode-for-BCM54210E-and-B5021.patch new file mode 100644 index 0000000000..db239e0a00 --- /dev/null +++ b/target/linux/generic/backport-4.19/071-v4.15-0001-net-bgmac-enable-master-mode-for-BCM54210E-and-B5021.patch @@ -0,0 +1,50 @@ +From 12acd136913ccdf394eeb2bc8686ff5505368119 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl> +Date: Thu, 12 Oct 2017 10:21:26 +0200 +Subject: [PATCH] net: bgmac: enable master mode for BCM54210E and B50212E PHYs +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +There are 4 very similar PHYs: +0x600d84a1: BCM54210E (rev B0) +0x600d84a2: BCM54210E (rev B1) +0x600d84a5: B50212E (rev B0) +0x600d84a6: B50212E (rev B1) +that need setting master mode manually. It's because they run in slave +mode by default with Automatic Slave/Master configuration disabled which +can lead to unreliable connection with massive ping loss. + +So far it was reported for a board with BCM47189 SoC and B50212E B1 PHY +connected to the bgmac supported ethernet device. Telling PHY driver to +setup PHY properly solves this issue. + +Signed-off-by: Rafał Miłecki <rafal@milecki.pl> +Signed-off-by: David S. Miller <davem@davemloft.net> +--- + drivers/net/ethernet/broadcom/bgmac-bcma.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/broadcom/bgmac-bcma.c ++++ b/drivers/net/ethernet/broadcom/bgmac-bcma.c +@@ -184,13 +184,19 @@ static int bgmac_probe(struct bcma_devic + + if (!bgmac_is_bcm4707_family(core) && + !(ci->id == BCMA_CHIP_ID_BCM53573 && core->core_unit == 1)) { ++ struct phy_device *phydev; ++ + mii_bus = bcma_mdio_mii_register(bgmac); + if (IS_ERR(mii_bus)) { + err = PTR_ERR(mii_bus); + goto err; + } +- + bgmac->mii_bus = mii_bus; ++ ++ phydev = mdiobus_get_phy(bgmac->mii_bus, bgmac->phyaddr); ++ if (ci->id == BCMA_CHIP_ID_BCM53573 && phydev && ++ (phydev->drv->phy_id & phydev->drv->phy_id_mask) == PHY_ID_BCM54210E) ++ phydev->dev_flags |= PHY_BRCM_EN_MASTER_MODE; + } + + if (core->bus->hosttype == BCMA_HOSTTYPE_PCI) { diff --git a/target/linux/generic/backport-4.19/076-v4.15-0001-net-phy-broadcom-support-new-device-flag-for-setting.patch b/target/linux/generic/backport-4.19/076-v4.15-0001-net-phy-broadcom-support-new-device-flag-for-setting.patch new file mode 100644 index 0000000000..a22d272656 --- /dev/null +++ b/target/linux/generic/backport-4.19/076-v4.15-0001-net-phy-broadcom-support-new-device-flag-for-setting.patch @@ -0,0 +1,54 @@ +From 2355a6546a053b1c16ebefd6ce1f0cccc00e1da5 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl> +Date: Thu, 12 Oct 2017 10:21:25 +0200 +Subject: [PATCH] net: phy: broadcom: support new device flag for setting + master mode +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Some of Broadcom's PHYs run by default in slave mode with Automatic +Slave/Master configuration disabled. It stops them from working properly +with some devices. + +So far it has been verified for BCM54210E and BCM50212E which don't +work well with Intel's I217-LM and I218-LM: +http://ark.intel.com/products/60019/Intel-Ethernet-Connection-I217-LM +http://ark.intel.com/products/71307/Intel-Ethernet-Connection-I218-LM +I was told there is massive ping loss. + +This commit adds support for a new flag which can be set by an ethernet +driver to fixup PHY setup. + +Signed-off-by: Rafał Miłecki <rafal@milecki.pl> +Signed-off-by: David S. Miller <davem@davemloft.net> +--- + drivers/net/phy/broadcom.c | 6 ++++++ + include/linux/brcmphy.h | 1 + + 2 files changed, 7 insertions(+) + +--- a/drivers/net/phy/broadcom.c ++++ b/drivers/net/phy/broadcom.c +@@ -43,6 +43,12 @@ static int bcm54210e_config_init(struct + val &= ~BCM54810_SHD_CLK_CTL_GTXCLK_EN; + bcm_phy_write_shadow(phydev, BCM54810_SHD_CLK_CTL, val); + ++ if (phydev->dev_flags & PHY_BRCM_EN_MASTER_MODE) { ++ val = phy_read(phydev, MII_CTRL1000); ++ val |= CTL1000_AS_MASTER | CTL1000_ENABLE_MASTER; ++ phy_write(phydev, MII_CTRL1000, val); ++ } ++ + return 0; + } + +--- a/include/linux/brcmphy.h ++++ b/include/linux/brcmphy.h +@@ -64,6 +64,7 @@ + #define PHY_BRCM_EXT_IBND_TX_ENABLE 0x00002000 + #define PHY_BRCM_CLEAR_RGMII_MODE 0x00004000 + #define PHY_BRCM_DIS_TXCRXC_NOENRGY 0x00008000 ++#define PHY_BRCM_EN_MASTER_MODE 0x00010000 + + /* Broadcom BCM7xxx specific workarounds */ + #define PHY_BRCM_7XXX_REV(x) (((x) >> 8) & 0xff) diff --git a/target/linux/generic/backport-4.19/085-v4.16-0001-i2c-gpio-Enable-working-over-slow-can_sleep-GPIOs.patch b/target/linux/generic/backport-4.19/085-v4.16-0001-i2c-gpio-Enable-working-over-slow-can_sleep-GPIOs.patch new file mode 100644 index 0000000000..ead6675e0b --- /dev/null +++ b/target/linux/generic/backport-4.19/085-v4.16-0001-i2c-gpio-Enable-working-over-slow-can_sleep-GPIOs.patch @@ -0,0 +1,84 @@ +From f11a04464ae57e8db1bb7634547842b43e36a898 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jan=20Kundr=C3=A1t?= <jan.kundrat@cesnet.cz> +Date: Fri, 22 Dec 2017 22:47:16 +0100 +Subject: i2c: gpio: Enable working over slow can_sleep GPIOs +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +"Slow" GPIOs (usually those connected over an SPI or an I2C bus) are, +well, slow in their operation. It is generally a good idea to avoid +using them for time-critical operation, but sometimes the hardware just +sucks, and the software has to cope. In addition to that, the I2C bus +itself does not actually define any strict timing limits; the bus is +free to go all the way down to DC. The timeouts (and therefore the +slowest acceptable frequency) are present only in SMBus. + +The `can_sleep` is IMHO a wrong concept to use here. My SPI-to-quad-UART +chip (MAX14830) is connected via a 26MHz SPI bus, and it happily drives +SCL at 200kHz (5µs pulses) during my benchmarks. That's faster than the +maximal allowed speed of the traditional I2C. + +The previous version of this code did not really block operation over +slow GPIO pins, anyway. Instead, it just resorted to printing a warning +with a backtrace each time a GPIO pin was accessed, thereby slowing +things down even more. + +Finally, it's not just me. A similar patch was originally submitted in +2015 [1]. + +[1] https://patchwork.ozlabs.org/patch/450956/ + +Signed-off-by: Jan Kundrát <jan.kundrat@cesnet.cz> +Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> +Signed-off-by: Wolfram Sang <wsa@the-dreams.de> +--- + drivers/i2c/busses/i2c-gpio.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/drivers/i2c/busses/i2c-gpio.c ++++ b/drivers/i2c/busses/i2c-gpio.c +@@ -44,7 +44,7 @@ static void i2c_gpio_setsda_val(void *da + { + struct i2c_gpio_platform_data *pdata = data; + +- gpio_set_value(pdata->sda_pin, state); ++ gpio_set_value_cansleep(pdata->sda_pin, state); + } + + /* Toggle SCL by changing the direction of the pin. */ +@@ -68,21 +68,21 @@ static void i2c_gpio_setscl_val(void *da + { + struct i2c_gpio_platform_data *pdata = data; + +- gpio_set_value(pdata->scl_pin, state); ++ gpio_set_value_cansleep(pdata->scl_pin, state); + } + + static int i2c_gpio_getsda(void *data) + { + struct i2c_gpio_platform_data *pdata = data; + +- return gpio_get_value(pdata->sda_pin); ++ return gpio_get_value_cansleep(pdata->sda_pin); + } + + static int i2c_gpio_getscl(void *data) + { + struct i2c_gpio_platform_data *pdata = data; + +- return gpio_get_value(pdata->scl_pin); ++ return gpio_get_value_cansleep(pdata->scl_pin); + } + + static int of_i2c_gpio_get_pins(struct device_node *np, +@@ -175,6 +175,9 @@ static int i2c_gpio_probe(struct platfor + memcpy(pdata, dev_get_platdata(&pdev->dev), sizeof(*pdata)); + } + ++ if (gpiod_cansleep(gpio_to_desc(pdata->sda_pin)) || gpiod_cansleep(gpio_to_desc(pdata->scl_pin))) ++ dev_warn(&pdev->dev, "Slow GPIO pins might wreak havoc into I2C/SMBus bus timing"); ++ + if (pdata->sda_is_open_drain) { + gpio_direction_output(pdata->sda_pin, 1); + bit_data->setsda = i2c_gpio_setsda_val; diff --git a/target/linux/generic/backport-4.19/090-net-bridge-add-support-for-port-isolation.patch b/target/linux/generic/backport-4.19/090-net-bridge-add-support-for-port-isolation.patch new file mode 100644 index 0000000000..6237177a45 --- /dev/null +++ b/target/linux/generic/backport-4.19/090-net-bridge-add-support-for-port-isolation.patch @@ -0,0 +1,145 @@ +From: Nikolay Aleksandrov <nikolay@cumulusnetworks.com> +Date: Thu, 24 May 2018 11:56:48 +0300 +Subject: [PATCH] net: bridge: add support for port isolation + +This patch adds support for a new port flag - BR_ISOLATED. If it is set +then isolated ports cannot communicate between each other, but they can +still communicate with non-isolated ports. The same can be achieved via +ACLs but they can't scale with large number of ports and also the +complexity of the rules grows. This feature can be used to achieve +isolated vlan functionality (similar to pvlan) as well, though currently +it will be port-wide (for all vlans on the port). The new test in +should_deliver uses data that is already cache hot and the new boolean +is used to avoid an additional source port test in should_deliver. + +Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com> +Reviewed-by: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp> +Signed-off-by: David S. Miller <davem@davemloft.net> +--- + +--- a/include/uapi/linux/if_link.h ++++ b/include/uapi/linux/if_link.h +@@ -326,6 +326,8 @@ enum { + IFLA_BRPORT_MCAST_TO_UCAST, + IFLA_BRPORT_VLAN_TUNNEL, + IFLA_BRPORT_BCAST_FLOOD, ++ IFLA_BRPORT_NEIGH_SUPPRESS, ++ IFLA_BRPORT_ISOLATED, + __IFLA_BRPORT_MAX + }; + #define IFLA_BRPORT_MAX (__IFLA_BRPORT_MAX - 1) +--- a/net/bridge/br_forward.c ++++ b/net/bridge/br_forward.c +@@ -30,7 +30,8 @@ static inline int should_deliver(const s + vg = nbp_vlan_group_rcu(p); + return ((p->flags & BR_HAIRPIN_MODE) || skb->dev != p->dev) && + br_allowed_egress(vg, skb) && p->state == BR_STATE_FORWARDING && +- nbp_switchdev_allowed_egress(p, skb); ++ nbp_switchdev_allowed_egress(p, skb) && ++ !br_skb_isolated(p, skb); + } + + int br_dev_queue_push_xmit(struct net *net, struct sock *sk, struct sk_buff *skb) +--- a/net/bridge/br_input.c ++++ b/net/bridge/br_input.c +@@ -170,6 +170,7 @@ int br_handle_frame_finish(struct net *n + goto drop; + + BR_INPUT_SKB_CB(skb)->brdev = br->dev; ++ BR_INPUT_SKB_CB(skb)->src_port_isolated = !!(p->flags & BR_ISOLATED); + + if (IS_ENABLED(CONFIG_INET) && skb->protocol == htons(ETH_P_ARP)) + br_do_proxy_arp(skb, br, vid, p); +--- a/net/bridge/br_netlink.c ++++ b/net/bridge/br_netlink.c +@@ -138,6 +138,7 @@ static inline size_t br_port_info_size(v + + nla_total_size(1) /* IFLA_BRPORT_PROXYARP */ + + nla_total_size(1) /* IFLA_BRPORT_PROXYARP_WIFI */ + + nla_total_size(1) /* IFLA_BRPORT_VLAN_TUNNEL */ ++ + nla_total_size(1) /* IFLA_BRPORT_ISOLATED */ + + nla_total_size(sizeof(struct ifla_bridge_id)) /* IFLA_BRPORT_ROOT_ID */ + + nla_total_size(sizeof(struct ifla_bridge_id)) /* IFLA_BRPORT_BRIDGE_ID */ + + nla_total_size(sizeof(u16)) /* IFLA_BRPORT_DESIGNATED_PORT */ +@@ -208,7 +209,8 @@ static int br_port_fill_attrs(struct sk_ + p->topology_change_ack) || + nla_put_u8(skb, IFLA_BRPORT_CONFIG_PENDING, p->config_pending) || + nla_put_u8(skb, IFLA_BRPORT_VLAN_TUNNEL, !!(p->flags & +- BR_VLAN_TUNNEL))) ++ BR_VLAN_TUNNEL)) || ++ nla_put_u8(skb, IFLA_BRPORT_ISOLATED, !!(p->flags & BR_ISOLATED))) + return -EMSGSIZE; + + timerval = br_timer_value(&p->message_age_timer); +@@ -637,6 +639,7 @@ static const struct nla_policy br_port_p + [IFLA_BRPORT_MCAST_TO_UCAST] = { .type = NLA_U8 }, + [IFLA_BRPORT_MCAST_FLOOD] = { .type = NLA_U8 }, + [IFLA_BRPORT_BCAST_FLOOD] = { .type = NLA_U8 }, ++ [IFLA_BRPORT_ISOLATED] = { .type = NLA_U8 }, + }; + + /* Change the state of the port and notify spanning tree */ +@@ -773,6 +776,11 @@ static int br_setport(struct net_bridge_ + return err; + } + #endif ++ ++ err = br_set_port_flag(p, tb, IFLA_BRPORT_ISOLATED, BR_ISOLATED); ++ if (err) ++ return err; ++ + br_port_flags_change(p, old_flags ^ p->flags); + return 0; + } +--- a/net/bridge/br_private.h ++++ b/net/bridge/br_private.h +@@ -407,6 +407,7 @@ struct br_input_skb_cb { + #endif + + bool proxyarp_replied; ++ bool src_port_isolated; + + #ifdef CONFIG_BRIDGE_VLAN_FILTERING + bool vlan_filtered; +@@ -554,6 +555,14 @@ int br_forward_finish(struct net *net, s + void br_flood(struct net_bridge *br, struct sk_buff *skb, + enum br_pkt_type pkt_type, bool local_rcv, bool local_orig); + ++/* return true if both source port and dest port are isolated */ ++static inline bool br_skb_isolated(const struct net_bridge_port *to, ++ const struct sk_buff *skb) ++{ ++ return BR_INPUT_SKB_CB(skb)->src_port_isolated && ++ (to->flags & BR_ISOLATED); ++} ++ + /* br_if.c */ + void br_port_carrier_check(struct net_bridge_port *p); + int br_add_bridge(struct net *net, const char *name); +--- a/net/bridge/br_sysfs_if.c ++++ b/net/bridge/br_sysfs_if.c +@@ -174,6 +174,7 @@ BRPORT_ATTR_FLAG(proxyarp, BR_PROXYARP); + BRPORT_ATTR_FLAG(proxyarp_wifi, BR_PROXYARP_WIFI); + BRPORT_ATTR_FLAG(multicast_flood, BR_MCAST_FLOOD); + BRPORT_ATTR_FLAG(broadcast_flood, BR_BCAST_FLOOD); ++BRPORT_ATTR_FLAG(isolated, BR_ISOLATED); + + #ifdef CONFIG_BRIDGE_IGMP_SNOOPING + static ssize_t show_multicast_router(struct net_bridge_port *p, char *buf) +@@ -223,6 +224,7 @@ static const struct brport_attribute *br + &brport_attr_proxyarp_wifi, + &brport_attr_multicast_flood, + &brport_attr_broadcast_flood, ++ &brport_attr_isolated, + NULL + }; + +--- a/include/linux/if_bridge.h ++++ b/include/linux/if_bridge.h +@@ -49,6 +49,7 @@ struct br_ip_list { + #define BR_MULTICAST_TO_UNICAST BIT(12) + #define BR_VLAN_TUNNEL BIT(13) + #define BR_BCAST_FLOOD BIT(14) ++#define BR_ISOLATED BIT(16) + + #define BR_DEFAULT_AGEING_TIME (300 * HZ) + diff --git a/target/linux/generic/backport-4.19/272-uapi-if_ether.h-prevent-redefinition-of-struct-ethhd.patch b/target/linux/generic/backport-4.19/272-uapi-if_ether.h-prevent-redefinition-of-struct-ethhd.patch new file mode 100644 index 0000000000..45039ce133 --- /dev/null +++ b/target/linux/generic/backport-4.19/272-uapi-if_ether.h-prevent-redefinition-of-struct-ethhd.patch @@ -0,0 +1,55 @@ +From 649affd04813c43e0a72886517fcfccd63230981 Mon Sep 17 00:00:00 2001 +From: Hauke Mehrtens <hauke@hauke-m.de> +Date: Mon, 29 Jun 2015 16:53:03 +0200 +Subject: uapi/if_ether.h: prevent redefinition of struct ethhdr + +Musl provides its own ethhdr struct definition. Add a guard to prevent +its definition of the appropriate musl header has already been included. + +glibc does not implement this header, but when glibc will implement this +they can just define __UAPI_DEF_ETHHDR 0 to make it work with the +kernel. + +Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> +--- + include/uapi/linux/if_ether.h | 3 +++ + include/uapi/linux/libc-compat.h | 6 ++++++ + 2 files changed, 9 insertions(+) + +--- a/include/uapi/linux/if_ether.h ++++ b/include/uapi/linux/if_ether.h +@@ -23,6 +23,7 @@ + #define _UAPI_LINUX_IF_ETHER_H + + #include <linux/types.h> ++#include <linux/libc-compat.h> + + /* + * IEEE 802.3 Ethernet magic constants. The frame sizes omit the preamble +@@ -150,11 +151,13 @@ + * This is an Ethernet frame header. + */ + ++#if __UAPI_DEF_ETHHDR + struct ethhdr { + unsigned char h_dest[ETH_ALEN]; /* destination eth addr */ + unsigned char h_source[ETH_ALEN]; /* source ether addr */ + __be16 h_proto; /* packet type ID field */ + } __attribute__((packed)); ++#endif + + + #endif /* _UAPI_LINUX_IF_ETHER_H */ +--- a/include/uapi/linux/libc-compat.h ++++ b/include/uapi/linux/libc-compat.h +@@ -264,4 +264,10 @@ + + #endif /* __GLIBC__ */ + ++/* Definitions for if_ether.h */ ++/* allow libcs like musl to deactivate this, glibc does not implement this. */ ++#ifndef __UAPI_DEF_ETHHDR ++#define __UAPI_DEF_ETHHDR 1 ++#endif ++ + #endif /* _UAPI_LIBC_COMPAT_H */ diff --git a/target/linux/generic/backport-4.19/289-v4.16-netfilter-add-defines-for-arp-decnet-max-hooks.patch b/target/linux/generic/backport-4.19/289-v4.16-netfilter-add-defines-for-arp-decnet-max-hooks.patch new file mode 100644 index 0000000000..f7898d4f30 --- /dev/null +++ b/target/linux/generic/backport-4.19/289-v4.16-netfilter-add-defines-for-arp-decnet-max-hooks.patch @@ -0,0 +1,67 @@ +From e58f33cc84bc089c430ac955f3cad6380ae98591 Mon Sep 17 00:00:00 2001 +From: Florian Westphal <fw@strlen.de> +Date: Thu, 7 Dec 2017 16:28:23 +0100 +Subject: [PATCH] netfilter: add defines for arp/decnet max hooks + +The kernel already has defines for this, but they are in uapi exposed +headers. + +Including these from netns.h causes build errors and also adds unneeded +dependencies on heads that we don't need. + +So move these defines to netfilter_defs.h and place the uapi ones +in ifndef __KERNEL__ to keep them for userspace. + +Signed-off-by: Florian Westphal <fw@strlen.de> +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + include/linux/netfilter_defs.h | 6 ++++++ + include/uapi/linux/netfilter_arp.h | 3 +++ + include/uapi/linux/netfilter_decnet.h | 4 +++- + 3 files changed, 12 insertions(+), 1 deletion(-) + +--- a/include/linux/netfilter_defs.h ++++ b/include/linux/netfilter_defs.h +@@ -7,4 +7,10 @@ + /* Largest hook number + 1, see uapi/linux/netfilter_decnet.h */ + #define NF_MAX_HOOKS 8 + ++/* in/out/forward only */ ++#define NF_ARP_NUMHOOKS 3 ++ ++/* max hook is NF_DN_ROUTE (6), also see uapi/linux/netfilter_decnet.h */ ++#define NF_DN_NUMHOOKS 7 ++ + #endif +--- a/include/uapi/linux/netfilter_arp.h ++++ b/include/uapi/linux/netfilter_arp.h +@@ -15,6 +15,9 @@ + #define NF_ARP_IN 0 + #define NF_ARP_OUT 1 + #define NF_ARP_FORWARD 2 ++ ++#ifndef __KERNEL__ + #define NF_ARP_NUMHOOKS 3 ++#endif + + #endif /* __LINUX_ARP_NETFILTER_H */ +--- a/include/uapi/linux/netfilter_decnet.h ++++ b/include/uapi/linux/netfilter_decnet.h +@@ -24,6 +24,9 @@ + #define NFC_DN_IF_IN 0x0004 + /* Output device. */ + #define NFC_DN_IF_OUT 0x0008 ++ ++/* kernel define is in netfilter_defs.h */ ++#define NF_DN_NUMHOOKS 7 + #endif /* ! __KERNEL__ */ + + /* DECnet Hooks */ +@@ -41,7 +44,6 @@ + #define NF_DN_HELLO 5 + /* Input Routing Packets */ + #define NF_DN_ROUTE 6 +-#define NF_DN_NUMHOOKS 7 + + enum nf_dn_hook_priorities { + NF_DN_PRI_FIRST = INT_MIN, diff --git a/target/linux/generic/backport-4.19/290-v4.16-netfilter-core-make-nf_unregister_net_hooks-simple-w.patch b/target/linux/generic/backport-4.19/290-v4.16-netfilter-core-make-nf_unregister_net_hooks-simple-w.patch new file mode 100644 index 0000000000..35800c4acf --- /dev/null +++ b/target/linux/generic/backport-4.19/290-v4.16-netfilter-core-make-nf_unregister_net_hooks-simple-w.patch @@ -0,0 +1,91 @@ +From 4e645b47c4f000a503b9c90163ad905786b9bc1d Mon Sep 17 00:00:00 2001 +From: Florian Westphal <fw@strlen.de> +Date: Fri, 1 Dec 2017 00:21:02 +0100 +Subject: [PATCH 02/11] netfilter: core: make nf_unregister_net_hooks simple + wrapper again + +This reverts commit d3ad2c17b4047 +("netfilter: core: batch nf_unregister_net_hooks synchronize_net calls"). + +Nothing wrong with it. However, followup patch will delay freeing of hooks +with call_rcu, so all synchronize_net() calls become obsolete and there +is no need anymore for this batching. + +This revert causes a temporary performance degradation when destroying +network namespace, but its resolved with the upcoming call_rcu conversion. + +Signed-off-by: Florian Westphal <fw@strlen.de> +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + net/netfilter/core.c | 59 +++------------------------------------------------- + 1 file changed, 3 insertions(+), 56 deletions(-) + +--- a/net/netfilter/core.c ++++ b/net/netfilter/core.c +@@ -395,63 +395,10 @@ EXPORT_SYMBOL(nf_register_net_hooks); + void nf_unregister_net_hooks(struct net *net, const struct nf_hook_ops *reg, + unsigned int hookcount) + { +- struct nf_hook_entries *to_free[16], *p; +- struct nf_hook_entries __rcu **pp; +- unsigned int i, j, n; ++ unsigned int i; + +- mutex_lock(&nf_hook_mutex); +- for (i = 0; i < hookcount; i++) { +- pp = nf_hook_entry_head(net, ®[i]); +- if (!pp) +- continue; +- +- p = nf_entry_dereference(*pp); +- if (WARN_ON_ONCE(!p)) +- continue; +- __nf_unregister_net_hook(p, ®[i]); +- } +- mutex_unlock(&nf_hook_mutex); +- +- do { +- n = min_t(unsigned int, hookcount, ARRAY_SIZE(to_free)); +- +- mutex_lock(&nf_hook_mutex); +- +- for (i = 0, j = 0; i < hookcount && j < n; i++) { +- pp = nf_hook_entry_head(net, ®[i]); +- if (!pp) +- continue; +- +- p = nf_entry_dereference(*pp); +- if (!p) +- continue; +- +- to_free[j] = __nf_hook_entries_try_shrink(pp); +- if (to_free[j]) +- ++j; +- } +- +- mutex_unlock(&nf_hook_mutex); +- +- if (j) { +- unsigned int nfq; +- +- synchronize_net(); +- +- /* need 2nd synchronize_net() if nfqueue is used, skb +- * can get reinjected right before nf_queue_hook_drop() +- */ +- nfq = nf_queue_nf_hook_drop(net); +- if (nfq) +- synchronize_net(); +- +- for (i = 0; i < j; i++) +- kvfree(to_free[i]); +- } +- +- reg += n; +- hookcount -= n; +- } while (hookcount > 0); ++ for (i = 0; i < hookcount; i++) ++ nf_unregister_net_hook(net, ®[i]); + } + EXPORT_SYMBOL(nf_unregister_net_hooks); + diff --git a/target/linux/generic/backport-4.19/291-v4.16-netfilter-core-remove-synchronize_net-call-if-nfqueu.patch b/target/linux/generic/backport-4.19/291-v4.16-netfilter-core-remove-synchronize_net-call-if-nfqueu.patch new file mode 100644 index 0000000000..0ac5783624 --- /dev/null +++ b/target/linux/generic/backport-4.19/291-v4.16-netfilter-core-remove-synchronize_net-call-if-nfqueu.patch @@ -0,0 +1,116 @@ +From 26888dfd7e7454686b8d3ea9ba5045d5f236e4d7 Mon Sep 17 00:00:00 2001 +From: Florian Westphal <fw@strlen.de> +Date: Fri, 1 Dec 2017 00:21:03 +0100 +Subject: [PATCH 03/11] netfilter: core: remove synchronize_net call if nfqueue + is used + +since commit 960632ece6949b ("netfilter: convert hook list to an array") +nfqueue no longer stores a pointer to the hook that caused the packet +to be queued. Therefore no extra synchronize_net() call is needed after +dropping the packets enqueued by the old rule blob. + +Signed-off-by: Florian Westphal <fw@strlen.de> +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + include/net/netfilter/nf_queue.h | 2 +- + net/netfilter/core.c | 6 +----- + net/netfilter/nf_internals.h | 2 +- + net/netfilter/nf_queue.c | 7 ++----- + net/netfilter/nfnetlink_queue.c | 9 ++------- + 5 files changed, 7 insertions(+), 19 deletions(-) + +--- a/include/net/netfilter/nf_queue.h ++++ b/include/net/netfilter/nf_queue.h +@@ -25,7 +25,7 @@ struct nf_queue_entry { + struct nf_queue_handler { + int (*outfn)(struct nf_queue_entry *entry, + unsigned int queuenum); +- unsigned int (*nf_hook_drop)(struct net *net); ++ void (*nf_hook_drop)(struct net *net); + }; + + void nf_register_queue_handler(struct net *net, const struct nf_queue_handler *qh); +--- a/net/netfilter/core.c ++++ b/net/netfilter/core.c +@@ -341,7 +341,6 @@ void nf_unregister_net_hook(struct net * + { + struct nf_hook_entries __rcu **pp; + struct nf_hook_entries *p; +- unsigned int nfq; + + pp = nf_hook_entry_head(net, reg); + if (!pp) +@@ -364,10 +363,7 @@ void nf_unregister_net_hook(struct net * + + synchronize_net(); + +- /* other cpu might still process nfqueue verdict that used reg */ +- nfq = nf_queue_nf_hook_drop(net); +- if (nfq) +- synchronize_net(); ++ nf_queue_nf_hook_drop(net); + kvfree(p); + } + EXPORT_SYMBOL(nf_unregister_net_hook); +--- a/net/netfilter/nf_internals.h ++++ b/net/netfilter/nf_internals.h +@@ -10,7 +10,7 @@ + int nf_queue(struct sk_buff *skb, struct nf_hook_state *state, + const struct nf_hook_entries *entries, unsigned int index, + unsigned int verdict); +-unsigned int nf_queue_nf_hook_drop(struct net *net); ++void nf_queue_nf_hook_drop(struct net *net); + + /* nf_log.c */ + int __init netfilter_log_init(void); +--- a/net/netfilter/nf_queue.c ++++ b/net/netfilter/nf_queue.c +@@ -96,18 +96,15 @@ void nf_queue_entry_get_refs(struct nf_q + } + EXPORT_SYMBOL_GPL(nf_queue_entry_get_refs); + +-unsigned int nf_queue_nf_hook_drop(struct net *net) ++void nf_queue_nf_hook_drop(struct net *net) + { + const struct nf_queue_handler *qh; +- unsigned int count = 0; + + rcu_read_lock(); + qh = rcu_dereference(net->nf.queue_handler); + if (qh) +- count = qh->nf_hook_drop(net); ++ qh->nf_hook_drop(net); + rcu_read_unlock(); +- +- return count; + } + EXPORT_SYMBOL_GPL(nf_queue_nf_hook_drop); + +--- a/net/netfilter/nfnetlink_queue.c ++++ b/net/netfilter/nfnetlink_queue.c +@@ -941,23 +941,18 @@ static struct notifier_block nfqnl_dev_n + .notifier_call = nfqnl_rcv_dev_event, + }; + +-static unsigned int nfqnl_nf_hook_drop(struct net *net) ++static void nfqnl_nf_hook_drop(struct net *net) + { + struct nfnl_queue_net *q = nfnl_queue_pernet(net); +- unsigned int instances = 0; + int i; + + for (i = 0; i < INSTANCE_BUCKETS; i++) { + struct nfqnl_instance *inst; + struct hlist_head *head = &q->instance_table[i]; + +- hlist_for_each_entry_rcu(inst, head, hlist) { ++ hlist_for_each_entry_rcu(inst, head, hlist) + nfqnl_flush(inst, NULL, 0); +- instances++; +- } + } +- +- return instances; + } + + static int diff --git a/target/linux/generic/backport-4.19/292-v4.16-netfilter-core-free-hooks-with-call_rcu.patch b/target/linux/generic/backport-4.19/292-v4.16-netfilter-core-free-hooks-with-call_rcu.patch new file mode 100644 index 0000000000..5eca73552b --- /dev/null +++ b/target/linux/generic/backport-4.19/292-v4.16-netfilter-core-free-hooks-with-call_rcu.patch @@ -0,0 +1,132 @@ +From 8c873e2199700c2de7dbd5eedb9d90d5f109462b Mon Sep 17 00:00:00 2001 +From: Florian Westphal <fw@strlen.de> +Date: Fri, 1 Dec 2017 00:21:04 +0100 +Subject: [PATCH 04/11] netfilter: core: free hooks with call_rcu + +Giuseppe Scrivano says: + "SELinux, if enabled, registers for each new network namespace 6 + netfilter hooks." + +Cost for this is high. With synchronize_net() removed: + "The net benefit on an SMP machine with two cores is that creating a + new network namespace takes -40% of the original time." + +This patch replaces synchronize_net+kvfree with call_rcu(). +We store rcu_head at the tail of a structure that has no fixed layout, +i.e. we cannot use offsetof() to compute the start of the original +allocation. Thus store this information right after the rcu head. + +We could simplify this by just placing the rcu_head at the start +of struct nf_hook_entries. However, this structure is used in +packet processing hotpath, so only place what is needed for that +at the beginning of the struct. + +Reported-by: Giuseppe Scrivano <gscrivan@redhat.com> +Signed-off-by: Florian Westphal <fw@strlen.de> +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + include/linux/netfilter.h | 19 +++++++++++++++---- + net/netfilter/core.c | 34 ++++++++++++++++++++++++++++------ + 2 files changed, 43 insertions(+), 10 deletions(-) + +--- a/include/linux/netfilter.h ++++ b/include/linux/netfilter.h +@@ -77,17 +77,28 @@ struct nf_hook_entry { + void *priv; + }; + ++struct nf_hook_entries_rcu_head { ++ struct rcu_head head; ++ void *allocation; ++}; ++ + struct nf_hook_entries { + u16 num_hook_entries; + /* padding */ + struct nf_hook_entry hooks[]; + +- /* trailer: pointers to original orig_ops of each hook. +- * +- * This is not part of struct nf_hook_entry since its only +- * needed in slow path (hook register/unregister). ++ /* trailer: pointers to original orig_ops of each hook, ++ * followed by rcu_head and scratch space used for freeing ++ * the structure via call_rcu. + * ++ * This is not part of struct nf_hook_entry since its only ++ * needed in slow path (hook register/unregister): + * const struct nf_hook_ops *orig_ops[] ++ * ++ * For the same reason, we store this at end -- its ++ * only needed when a hook is deleted, not during ++ * packet path processing: ++ * struct nf_hook_entries_rcu_head head + */ + }; + +--- a/net/netfilter/core.c ++++ b/net/netfilter/core.c +@@ -74,7 +74,8 @@ static struct nf_hook_entries *allocate_ + struct nf_hook_entries *e; + size_t alloc = sizeof(*e) + + sizeof(struct nf_hook_entry) * num + +- sizeof(struct nf_hook_ops *) * num; ++ sizeof(struct nf_hook_ops *) * num + ++ sizeof(struct nf_hook_entries_rcu_head); + + if (num == 0) + return NULL; +@@ -85,6 +86,30 @@ static struct nf_hook_entries *allocate_ + return e; + } + ++static void __nf_hook_entries_free(struct rcu_head *h) ++{ ++ struct nf_hook_entries_rcu_head *head; ++ ++ head = container_of(h, struct nf_hook_entries_rcu_head, head); ++ kvfree(head->allocation); ++} ++ ++static void nf_hook_entries_free(struct nf_hook_entries *e) ++{ ++ struct nf_hook_entries_rcu_head *head; ++ struct nf_hook_ops **ops; ++ unsigned int num; ++ ++ if (!e) ++ return; ++ ++ num = e->num_hook_entries; ++ ops = nf_hook_entries_get_hook_ops(e); ++ head = (void *)&ops[num]; ++ head->allocation = e; ++ call_rcu(&head->head, __nf_hook_entries_free); ++} ++ + static unsigned int accept_all(void *priv, + struct sk_buff *skb, + const struct nf_hook_state *state) +@@ -291,9 +316,8 @@ int nf_register_net_hook(struct net *net + #ifdef HAVE_JUMP_LABEL + static_key_slow_inc(&nf_hooks_needed[reg->pf][reg->hooknum]); + #endif +- synchronize_net(); + BUG_ON(p == new_hooks); +- kvfree(p); ++ nf_hook_entries_free(p); + return 0; + } + EXPORT_SYMBOL(nf_register_net_hook); +@@ -361,10 +385,8 @@ void nf_unregister_net_hook(struct net * + if (!p) + return; + +- synchronize_net(); +- + nf_queue_nf_hook_drop(net); +- kvfree(p); ++ nf_hook_entries_free(p); + } + EXPORT_SYMBOL(nf_unregister_net_hook); + diff --git a/target/linux/generic/backport-4.19/293-v4.16-netfilter-reduce-size-of-hook-entry-point-locations.patch b/target/linux/generic/backport-4.19/293-v4.16-netfilter-reduce-size-of-hook-entry-point-locations.patch new file mode 100644 index 0000000000..fcf54e9858 --- /dev/null +++ b/target/linux/generic/backport-4.19/293-v4.16-netfilter-reduce-size-of-hook-entry-point-locations.patch @@ -0,0 +1,200 @@ +From b0f38338aef2dae5ade3c16acf713737e3b15a73 Mon Sep 17 00:00:00 2001 +From: Florian Westphal <fw@strlen.de> +Date: Sun, 3 Dec 2017 00:58:47 +0100 +Subject: [PATCH 05/11] netfilter: reduce size of hook entry point locations + +struct net contains: + +struct nf_hook_entries __rcu *hooks[NFPROTO_NUMPROTO][NF_MAX_HOOKS]; + +which store the hook entry point locations for the various protocol +families and the hooks. + +Using array results in compact c code when doing accesses, i.e. + x = rcu_dereference(net->nf.hooks[pf][hook]); + +but its also wasting a lot of memory, as most families are +not used. + +So split the array into those families that are used, which +are only 5 (instead of 13). In most cases, the 'pf' argument is +constant, i.e. gcc removes switch statement. + +struct net before: + /* size: 5184, cachelines: 81, members: 46 */ +after: + /* size: 4672, cachelines: 73, members: 46 */ + +Signed-off-by: Florian Westphal <fw@strlen.de> +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + include/linux/netfilter.h | 24 ++++++++++++++++++++++-- + include/net/netns/netfilter.h | 6 +++++- + net/bridge/br_netfilter_hooks.c | 2 +- + net/netfilter/core.c | 38 ++++++++++++++++++++++++++++++-------- + net/netfilter/nf_queue.c | 21 +++++++++++++++++++-- + 5 files changed, 77 insertions(+), 14 deletions(-) + +--- a/include/linux/netfilter.h ++++ b/include/linux/netfilter.h +@@ -195,7 +195,7 @@ static inline int nf_hook(u_int8_t pf, u + struct net_device *indev, struct net_device *outdev, + int (*okfn)(struct net *, struct sock *, struct sk_buff *)) + { +- struct nf_hook_entries *hook_head; ++ struct nf_hook_entries *hook_head = NULL; + int ret = 1; + + #ifdef HAVE_JUMP_LABEL +@@ -206,7 +206,27 @@ static inline int nf_hook(u_int8_t pf, u + #endif + + rcu_read_lock(); +- hook_head = rcu_dereference(net->nf.hooks[pf][hook]); ++ switch (pf) { ++ case NFPROTO_IPV4: ++ hook_head = rcu_dereference(net->nf.hooks_ipv4[hook]); ++ break; ++ case NFPROTO_IPV6: ++ hook_head = rcu_dereference(net->nf.hooks_ipv6[hook]); ++ break; ++ case NFPROTO_ARP: ++ hook_head = rcu_dereference(net->nf.hooks_arp[hook]); ++ break; ++ case NFPROTO_BRIDGE: ++ hook_head = rcu_dereference(net->nf.hooks_bridge[hook]); ++ break; ++ case NFPROTO_DECNET: ++ hook_head = rcu_dereference(net->nf.hooks_decnet[hook]); ++ break; ++ default: ++ WARN_ON_ONCE(1); ++ break; ++ } ++ + if (hook_head) { + struct nf_hook_state state; + +--- a/include/net/netns/netfilter.h ++++ b/include/net/netns/netfilter.h +@@ -17,7 +17,11 @@ struct netns_nf { + #ifdef CONFIG_SYSCTL + struct ctl_table_header *nf_log_dir_header; + #endif +- struct nf_hook_entries __rcu *hooks[NFPROTO_NUMPROTO][NF_MAX_HOOKS]; ++ struct nf_hook_entries __rcu *hooks_ipv4[NF_MAX_HOOKS]; ++ struct nf_hook_entries __rcu *hooks_ipv6[NF_MAX_HOOKS]; ++ struct nf_hook_entries __rcu *hooks_arp[NF_MAX_HOOKS]; ++ struct nf_hook_entries __rcu *hooks_bridge[NF_MAX_HOOKS]; ++ struct nf_hook_entries __rcu *hooks_decnet[NF_MAX_HOOKS]; + #if IS_ENABLED(CONFIG_NF_DEFRAG_IPV4) + bool defrag_ipv4; + #endif +--- a/net/bridge/br_netfilter_hooks.c ++++ b/net/bridge/br_netfilter_hooks.c +@@ -992,7 +992,7 @@ int br_nf_hook_thresh(unsigned int hook, + unsigned int i; + int ret; + +- e = rcu_dereference(net->nf.hooks[NFPROTO_BRIDGE][hook]); ++ e = rcu_dereference(net->nf.hooks_bridge[hook]); + if (!e) + return okfn(net, sk, skb); + +--- a/net/netfilter/core.c ++++ b/net/netfilter/core.c +@@ -264,8 +264,23 @@ out_assign: + + static struct nf_hook_entries __rcu **nf_hook_entry_head(struct net *net, const struct nf_hook_ops *reg) + { +- if (reg->pf != NFPROTO_NETDEV) +- return net->nf.hooks[reg->pf]+reg->hooknum; ++ switch (reg->pf) { ++ case NFPROTO_NETDEV: ++ break; ++ case NFPROTO_ARP: ++ return net->nf.hooks_arp + reg->hooknum; ++ case NFPROTO_BRIDGE: ++ return net->nf.hooks_bridge + reg->hooknum; ++ case NFPROTO_IPV4: ++ return net->nf.hooks_ipv4 + reg->hooknum; ++ case NFPROTO_IPV6: ++ return net->nf.hooks_ipv6 + reg->hooknum; ++ case NFPROTO_DECNET: ++ return net->nf.hooks_decnet + reg->hooknum; ++ default: ++ WARN_ON_ONCE(1); ++ return NULL; ++ } + + #ifdef CONFIG_NETFILTER_INGRESS + if (reg->hooknum == NF_NETDEV_INGRESS) { +@@ -534,14 +549,21 @@ void (*nf_nat_decode_session_hook)(struc + EXPORT_SYMBOL(nf_nat_decode_session_hook); + #endif + +-static int __net_init netfilter_net_init(struct net *net) ++static void __net_init __netfilter_net_init(struct nf_hook_entries *e[NF_MAX_HOOKS]) + { +- int i, h; ++ int h; + +- for (i = 0; i < ARRAY_SIZE(net->nf.hooks); i++) { +- for (h = 0; h < NF_MAX_HOOKS; h++) +- RCU_INIT_POINTER(net->nf.hooks[i][h], NULL); +- } ++ for (h = 0; h < NF_MAX_HOOKS; h++) ++ RCU_INIT_POINTER(e[h], NULL); ++} ++ ++static int __net_init netfilter_net_init(struct net *net) ++{ ++ __netfilter_net_init(net->nf.hooks_ipv4); ++ __netfilter_net_init(net->nf.hooks_ipv6); ++ __netfilter_net_init(net->nf.hooks_arp); ++ __netfilter_net_init(net->nf.hooks_bridge); ++ __netfilter_net_init(net->nf.hooks_decnet); + + #ifdef CONFIG_PROC_FS + net->nf.proc_netfilter = proc_net_mkdir(net, "netfilter", +--- a/net/netfilter/nf_queue.c ++++ b/net/netfilter/nf_queue.c +@@ -201,6 +201,23 @@ repeat: + return NF_ACCEPT; + } + ++static struct nf_hook_entries *nf_hook_entries_head(const struct net *net, u8 pf, u8 hooknum) ++{ ++ switch (pf) { ++ case NFPROTO_BRIDGE: ++ return rcu_dereference(net->nf.hooks_bridge[hooknum]); ++ case NFPROTO_IPV4: ++ return rcu_dereference(net->nf.hooks_ipv4[hooknum]); ++ case NFPROTO_IPV6: ++ return rcu_dereference(net->nf.hooks_ipv6[hooknum]); ++ default: ++ WARN_ON_ONCE(1); ++ return NULL; ++ } ++ ++ return NULL; ++} ++ + /* Caller must hold rcu read-side lock */ + void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict) + { +@@ -216,12 +233,12 @@ void nf_reinject(struct nf_queue_entry * + net = entry->state.net; + pf = entry->state.pf; + +- hooks = rcu_dereference(net->nf.hooks[pf][entry->state.hook]); ++ hooks = nf_hook_entries_head(net, pf, entry->state.hook); + + nf_queue_entry_release_refs(entry); + + i = entry->hook_index; +- if (WARN_ON_ONCE(i >= hooks->num_hook_entries)) { ++ if (WARN_ON_ONCE(!hooks || i >= hooks->num_hook_entries)) { + kfree_skb(skb); + kfree(entry); + return; diff --git a/target/linux/generic/backport-4.19/294-v4.16-netfilter-reduce-hook-array-sizes-to-what-is-needed.patch b/target/linux/generic/backport-4.19/294-v4.16-netfilter-reduce-hook-array-sizes-to-what-is-needed.patch new file mode 100644 index 0000000000..d9009b8e1f --- /dev/null +++ b/target/linux/generic/backport-4.19/294-v4.16-netfilter-reduce-hook-array-sizes-to-what-is-needed.patch @@ -0,0 +1,95 @@ +From ef57170bbfdd6958281011332b1fd237712f69f0 Mon Sep 17 00:00:00 2001 +From: Florian Westphal <fw@strlen.de> +Date: Thu, 7 Dec 2017 16:28:24 +0100 +Subject: [PATCH 06/11] netfilter: reduce hook array sizes to what is needed + +Not all families share the same hook count, adjust sizes to what is +needed. + +struct net before: +/* size: 6592, cachelines: 103, members: 46 */ +after: +/* size: 5952, cachelines: 93, members: 46 */ + +Signed-off-by: Florian Westphal <fw@strlen.de> +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + include/net/netns/netfilter.h | 10 +++++----- + net/netfilter/core.c | 24 +++++++++++++++++------- + 2 files changed, 22 insertions(+), 12 deletions(-) + +--- a/include/net/netns/netfilter.h ++++ b/include/net/netns/netfilter.h +@@ -17,11 +17,11 @@ struct netns_nf { + #ifdef CONFIG_SYSCTL + struct ctl_table_header *nf_log_dir_header; + #endif +- struct nf_hook_entries __rcu *hooks_ipv4[NF_MAX_HOOKS]; +- struct nf_hook_entries __rcu *hooks_ipv6[NF_MAX_HOOKS]; +- struct nf_hook_entries __rcu *hooks_arp[NF_MAX_HOOKS]; +- struct nf_hook_entries __rcu *hooks_bridge[NF_MAX_HOOKS]; +- struct nf_hook_entries __rcu *hooks_decnet[NF_MAX_HOOKS]; ++ struct nf_hook_entries __rcu *hooks_ipv4[NF_INET_NUMHOOKS]; ++ struct nf_hook_entries __rcu *hooks_ipv6[NF_INET_NUMHOOKS]; ++ struct nf_hook_entries __rcu *hooks_arp[NF_ARP_NUMHOOKS]; ++ struct nf_hook_entries __rcu *hooks_bridge[NF_INET_NUMHOOKS]; ++ struct nf_hook_entries __rcu *hooks_decnet[NF_DN_NUMHOOKS]; + #if IS_ENABLED(CONFIG_NF_DEFRAG_IPV4) + bool defrag_ipv4; + #endif +--- a/net/netfilter/core.c ++++ b/net/netfilter/core.c +@@ -268,14 +268,24 @@ static struct nf_hook_entries __rcu **nf + case NFPROTO_NETDEV: + break; + case NFPROTO_ARP: ++ if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_arp) <= reg->hooknum)) ++ return NULL; + return net->nf.hooks_arp + reg->hooknum; + case NFPROTO_BRIDGE: ++ if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_bridge) <= reg->hooknum)) ++ return NULL; + return net->nf.hooks_bridge + reg->hooknum; + case NFPROTO_IPV4: ++ if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_ipv4) <= reg->hooknum)) ++ return NULL; + return net->nf.hooks_ipv4 + reg->hooknum; + case NFPROTO_IPV6: ++ if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_ipv6) <= reg->hooknum)) ++ return NULL; + return net->nf.hooks_ipv6 + reg->hooknum; + case NFPROTO_DECNET: ++ if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_decnet) <= reg->hooknum)) ++ return NULL; + return net->nf.hooks_decnet + reg->hooknum; + default: + WARN_ON_ONCE(1); +@@ -549,21 +559,21 @@ void (*nf_nat_decode_session_hook)(struc + EXPORT_SYMBOL(nf_nat_decode_session_hook); + #endif + +-static void __net_init __netfilter_net_init(struct nf_hook_entries *e[NF_MAX_HOOKS]) ++static void __net_init __netfilter_net_init(struct nf_hook_entries **e, int max) + { + int h; + +- for (h = 0; h < NF_MAX_HOOKS; h++) ++ for (h = 0; h < max; h++) + RCU_INIT_POINTER(e[h], NULL); + } + + static int __net_init netfilter_net_init(struct net *net) + { +- __netfilter_net_init(net->nf.hooks_ipv4); +- __netfilter_net_init(net->nf.hooks_ipv6); +- __netfilter_net_init(net->nf.hooks_arp); +- __netfilter_net_init(net->nf.hooks_bridge); +- __netfilter_net_init(net->nf.hooks_decnet); ++ __netfilter_net_init(net->nf.hooks_ipv4, ARRAY_SIZE(net->nf.hooks_ipv4)); ++ __netfilter_net_init(net->nf.hooks_ipv6, ARRAY_SIZE(net->nf.hooks_ipv6)); ++ __netfilter_net_init(net->nf.hooks_arp, ARRAY_SIZE(net->nf.hooks_arp)); ++ __netfilter_net_init(net->nf.hooks_bridge, ARRAY_SIZE(net->nf.hooks_bridge)); ++ __netfilter_net_init(net->nf.hooks_decnet, ARRAY_SIZE(net->nf.hooks_decnet)); + + #ifdef CONFIG_PROC_FS + net->nf.proc_netfilter = proc_net_mkdir(net, "netfilter", diff --git a/target/linux/generic/backport-4.19/295-v4.16-netfilter-don-t-allocate-space-for-decnet-hooks-unle.patch b/target/linux/generic/backport-4.19/295-v4.16-netfilter-don-t-allocate-space-for-decnet-hooks-unle.patch new file mode 100644 index 0000000000..26a93c40ae --- /dev/null +++ b/target/linux/generic/backport-4.19/295-v4.16-netfilter-don-t-allocate-space-for-decnet-hooks-unle.patch @@ -0,0 +1,67 @@ +From bb4badf3a3dc81190f7c1c1fa063cdefb18df45f Mon Sep 17 00:00:00 2001 +From: Florian Westphal <fw@strlen.de> +Date: Thu, 7 Dec 2017 16:28:25 +0100 +Subject: [PATCH 07/11] netfilter: don't allocate space for decnet hooks unless + needed + +no need to define hook points if the family isn't supported. + +Signed-off-by: Florian Westphal <fw@strlen.de> +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + include/linux/netfilter.h | 2 ++ + include/net/netns/netfilter.h | 2 ++ + net/netfilter/core.c | 4 ++++ + 3 files changed, 8 insertions(+) + +--- a/include/linux/netfilter.h ++++ b/include/linux/netfilter.h +@@ -219,9 +219,11 @@ static inline int nf_hook(u_int8_t pf, u + case NFPROTO_BRIDGE: + hook_head = rcu_dereference(net->nf.hooks_bridge[hook]); + break; ++#if IS_ENABLED(CONFIG_DECNET) + case NFPROTO_DECNET: + hook_head = rcu_dereference(net->nf.hooks_decnet[hook]); + break; ++#endif + default: + WARN_ON_ONCE(1); + break; +--- a/include/net/netns/netfilter.h ++++ b/include/net/netns/netfilter.h +@@ -21,7 +21,9 @@ struct netns_nf { + struct nf_hook_entries __rcu *hooks_ipv6[NF_INET_NUMHOOKS]; + struct nf_hook_entries __rcu *hooks_arp[NF_ARP_NUMHOOKS]; + struct nf_hook_entries __rcu *hooks_bridge[NF_INET_NUMHOOKS]; ++#if IS_ENABLED(CONFIG_DECNET) + struct nf_hook_entries __rcu *hooks_decnet[NF_DN_NUMHOOKS]; ++#endif + #if IS_ENABLED(CONFIG_NF_DEFRAG_IPV4) + bool defrag_ipv4; + #endif +--- a/net/netfilter/core.c ++++ b/net/netfilter/core.c +@@ -283,10 +283,12 @@ static struct nf_hook_entries __rcu **nf + if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_ipv6) <= reg->hooknum)) + return NULL; + return net->nf.hooks_ipv6 + reg->hooknum; ++#if IS_ENABLED(CONFIG_DECNET) + case NFPROTO_DECNET: + if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_decnet) <= reg->hooknum)) + return NULL; + return net->nf.hooks_decnet + reg->hooknum; ++#endif + default: + WARN_ON_ONCE(1); + return NULL; +@@ -573,7 +575,9 @@ static int __net_init netfilter_net_init + __netfilter_net_init(net->nf.hooks_ipv6, ARRAY_SIZE(net->nf.hooks_ipv6)); + __netfilter_net_init(net->nf.hooks_arp, ARRAY_SIZE(net->nf.hooks_arp)); + __netfilter_net_init(net->nf.hooks_bridge, ARRAY_SIZE(net->nf.hooks_bridge)); ++#if IS_ENABLED(CONFIG_DECNET) + __netfilter_net_init(net->nf.hooks_decnet, ARRAY_SIZE(net->nf.hooks_decnet)); ++#endif + + #ifdef CONFIG_PROC_FS + net->nf.proc_netfilter = proc_net_mkdir(net, "netfilter", diff --git a/target/linux/generic/backport-4.19/296-v4.16-netfilter-don-t-allocate-space-for-arp-bridge-hooks-.patch b/target/linux/generic/backport-4.19/296-v4.16-netfilter-don-t-allocate-space-for-arp-bridge-hooks-.patch new file mode 100644 index 0000000000..9444f6bb48 --- /dev/null +++ b/target/linux/generic/backport-4.19/296-v4.16-netfilter-don-t-allocate-space-for-arp-bridge-hooks-.patch @@ -0,0 +1,165 @@ +From 2a95183a5e0375df756efb2ca37602d71e8455f9 Mon Sep 17 00:00:00 2001 +From: Florian Westphal <fw@strlen.de> +Date: Thu, 7 Dec 2017 16:28:26 +0100 +Subject: [PATCH 08/11] netfilter: don't allocate space for arp/bridge hooks + unless needed + +no need to define hook points if the family isn't supported. +Because we need these hooks for either nftables, arp/ebtables +or the 'call-iptables' hack we have in the bridge layer add two +new dependencies, NETFILTER_FAMILY_{ARP,BRIDGE}, and have the +users select them. + +Signed-off-by: Florian Westphal <fw@strlen.de> +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + include/linux/netfilter.h | 4 ++++ + include/net/netns/netfilter.h | 4 ++++ + net/Kconfig | 1 + + net/bridge/netfilter/Kconfig | 2 ++ + net/ipv4/netfilter/Kconfig | 2 ++ + net/netfilter/Kconfig | 6 ++++++ + net/netfilter/core.c | 8 ++++++++ + net/netfilter/nf_queue.c | 2 ++ + 8 files changed, 29 insertions(+) + +--- a/include/linux/netfilter.h ++++ b/include/linux/netfilter.h +@@ -214,10 +214,14 @@ static inline int nf_hook(u_int8_t pf, u + hook_head = rcu_dereference(net->nf.hooks_ipv6[hook]); + break; + case NFPROTO_ARP: ++#ifdef CONFIG_NETFILTER_FAMILY_ARP + hook_head = rcu_dereference(net->nf.hooks_arp[hook]); ++#endif + break; + case NFPROTO_BRIDGE: ++#ifdef CONFIG_NETFILTER_FAMILY_BRIDGE + hook_head = rcu_dereference(net->nf.hooks_bridge[hook]); ++#endif + break; + #if IS_ENABLED(CONFIG_DECNET) + case NFPROTO_DECNET: +--- a/include/net/netns/netfilter.h ++++ b/include/net/netns/netfilter.h +@@ -19,8 +19,12 @@ struct netns_nf { + #endif + struct nf_hook_entries __rcu *hooks_ipv4[NF_INET_NUMHOOKS]; + struct nf_hook_entries __rcu *hooks_ipv6[NF_INET_NUMHOOKS]; ++#ifdef CONFIG_NETFILTER_FAMILY_ARP + struct nf_hook_entries __rcu *hooks_arp[NF_ARP_NUMHOOKS]; ++#endif ++#ifdef CONFIG_NETFILTER_FAMILY_BRIDGE + struct nf_hook_entries __rcu *hooks_bridge[NF_INET_NUMHOOKS]; ++#endif + #if IS_ENABLED(CONFIG_DECNET) + struct nf_hook_entries __rcu *hooks_decnet[NF_DN_NUMHOOKS]; + #endif +--- a/net/Kconfig ++++ b/net/Kconfig +@@ -182,6 +182,7 @@ config BRIDGE_NETFILTER + depends on BRIDGE + depends on NETFILTER && INET + depends on NETFILTER_ADVANCED ++ select NETFILTER_FAMILY_BRIDGE + default m + ---help--- + Enabling this option will let arptables resp. iptables see bridged +--- a/net/bridge/netfilter/Kconfig ++++ b/net/bridge/netfilter/Kconfig +@@ -4,6 +4,7 @@ + # + menuconfig NF_TABLES_BRIDGE + depends on BRIDGE && NETFILTER && NF_TABLES ++ select NETFILTER_FAMILY_BRIDGE + tristate "Ethernet Bridge nf_tables support" + + if NF_TABLES_BRIDGE +@@ -29,6 +30,7 @@ endif # NF_TABLES_BRIDGE + menuconfig BRIDGE_NF_EBTABLES + tristate "Ethernet Bridge tables (ebtables) support" + depends on BRIDGE && NETFILTER && NETFILTER_XTABLES ++ select NETFILTER_FAMILY_BRIDGE + help + ebtables is a general, extensible frame/packet identification + framework. Say 'Y' or 'M' here if you want to do Ethernet +--- a/net/ipv4/netfilter/Kconfig ++++ b/net/ipv4/netfilter/Kconfig +@@ -72,6 +72,7 @@ endif # NF_TABLES_IPV4 + + config NF_TABLES_ARP + tristate "ARP nf_tables support" ++ select NETFILTER_FAMILY_ARP + help + This option enables the ARP support for nf_tables. + +@@ -392,6 +393,7 @@ endif # IP_NF_IPTABLES + config IP_NF_ARPTABLES + tristate "ARP tables support" + select NETFILTER_XTABLES ++ select NETFILTER_FAMILY_ARP + depends on NETFILTER_ADVANCED + help + arptables is a general, extensible packet identification framework. +--- a/net/netfilter/Kconfig ++++ b/net/netfilter/Kconfig +@@ -12,6 +12,12 @@ config NETFILTER_INGRESS + config NETFILTER_NETLINK + tristate + ++config NETFILTER_FAMILY_BRIDGE ++ bool ++ ++config NETFILTER_FAMILY_ARP ++ bool ++ + config NETFILTER_NETLINK_ACCT + tristate "Netfilter NFACCT over NFNETLINK interface" + depends on NETFILTER_ADVANCED +--- a/net/netfilter/core.c ++++ b/net/netfilter/core.c +@@ -267,14 +267,18 @@ static struct nf_hook_entries __rcu **nf + switch (reg->pf) { + case NFPROTO_NETDEV: + break; ++#ifdef CONFIG_NETFILTER_FAMILY_ARP + case NFPROTO_ARP: + if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_arp) <= reg->hooknum)) + return NULL; + return net->nf.hooks_arp + reg->hooknum; ++#endif ++#ifdef CONFIG_NETFILTER_FAMILY_BRIDGE + case NFPROTO_BRIDGE: + if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_bridge) <= reg->hooknum)) + return NULL; + return net->nf.hooks_bridge + reg->hooknum; ++#endif + case NFPROTO_IPV4: + if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_ipv4) <= reg->hooknum)) + return NULL; +@@ -573,8 +577,12 @@ static int __net_init netfilter_net_init + { + __netfilter_net_init(net->nf.hooks_ipv4, ARRAY_SIZE(net->nf.hooks_ipv4)); + __netfilter_net_init(net->nf.hooks_ipv6, ARRAY_SIZE(net->nf.hooks_ipv6)); ++#ifdef CONFIG_NETFILTER_FAMILY_ARP + __netfilter_net_init(net->nf.hooks_arp, ARRAY_SIZE(net->nf.hooks_arp)); ++#endif ++#ifdef CONFIG_NETFILTER_FAMILY_BRIDGE + __netfilter_net_init(net->nf.hooks_bridge, ARRAY_SIZE(net->nf.hooks_bridge)); ++#endif + #if IS_ENABLED(CONFIG_DECNET) + __netfilter_net_init(net->nf.hooks_decnet, ARRAY_SIZE(net->nf.hooks_decnet)); + #endif +--- a/net/netfilter/nf_queue.c ++++ b/net/netfilter/nf_queue.c +@@ -204,8 +204,10 @@ repeat: + static struct nf_hook_entries *nf_hook_entries_head(const struct net *net, u8 pf, u8 hooknum) + { + switch (pf) { ++#ifdef CONFIG_NETFILTER_FAMILY_BRIDGE + case NFPROTO_BRIDGE: + return rcu_dereference(net->nf.hooks_bridge[hooknum]); ++#endif + case NFPROTO_IPV4: + return rcu_dereference(net->nf.hooks_ipv4[hooknum]); + case NFPROTO_IPV6: diff --git a/target/linux/generic/backport-4.19/297-v4.16-netfilter-core-pass-hook-number-family-and-device-to.patch b/target/linux/generic/backport-4.19/297-v4.16-netfilter-core-pass-hook-number-family-and-device-to.patch new file mode 100644 index 0000000000..7d450f95f0 --- /dev/null +++ b/target/linux/generic/backport-4.19/297-v4.16-netfilter-core-pass-hook-number-family-and-device-to.patch @@ -0,0 +1,98 @@ +From 62a0fe46e2aaba1812d3cbcae014a41539f9eb09 Mon Sep 17 00:00:00 2001 +From: Pablo Neira Ayuso <pablo@netfilter.org> +Date: Sat, 9 Dec 2017 15:23:51 +0100 +Subject: [PATCH 09/11] netfilter: core: pass hook number, family and device to + nf_find_hook_list() + +Instead of passing struct nf_hook_ops, this is needed by follow up +patches to handle NFPROTO_INET from the core. + +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + net/netfilter/core.c | 36 +++++++++++++++++++----------------- + 1 file changed, 19 insertions(+), 17 deletions(-) + +--- a/net/netfilter/core.c ++++ b/net/netfilter/core.c +@@ -262,36 +262,38 @@ out_assign: + return old; + } + +-static struct nf_hook_entries __rcu **nf_hook_entry_head(struct net *net, const struct nf_hook_ops *reg) ++static struct nf_hook_entries __rcu ** ++nf_hook_entry_head(struct net *net, int pf, unsigned int hooknum, ++ struct net_device *dev) + { +- switch (reg->pf) { ++ switch (pf) { + case NFPROTO_NETDEV: + break; + #ifdef CONFIG_NETFILTER_FAMILY_ARP + case NFPROTO_ARP: +- if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_arp) <= reg->hooknum)) ++ if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_arp) <= hooknum)) + return NULL; +- return net->nf.hooks_arp + reg->hooknum; ++ return net->nf.hooks_arp + hooknum; + #endif + #ifdef CONFIG_NETFILTER_FAMILY_BRIDGE + case NFPROTO_BRIDGE: +- if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_bridge) <= reg->hooknum)) ++ if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_bridge) <= hooknum)) + return NULL; +- return net->nf.hooks_bridge + reg->hooknum; ++ return net->nf.hooks_bridge + hooknum; + #endif + case NFPROTO_IPV4: +- if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_ipv4) <= reg->hooknum)) ++ if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_ipv4) <= hooknum)) + return NULL; +- return net->nf.hooks_ipv4 + reg->hooknum; ++ return net->nf.hooks_ipv4 + hooknum; + case NFPROTO_IPV6: +- if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_ipv6) <= reg->hooknum)) ++ if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_ipv6) <= hooknum)) + return NULL; +- return net->nf.hooks_ipv6 + reg->hooknum; ++ return net->nf.hooks_ipv6 + hooknum; + #if IS_ENABLED(CONFIG_DECNET) + case NFPROTO_DECNET: +- if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_decnet) <= reg->hooknum)) ++ if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_decnet) <= hooknum)) + return NULL; +- return net->nf.hooks_decnet + reg->hooknum; ++ return net->nf.hooks_decnet + hooknum; + #endif + default: + WARN_ON_ONCE(1); +@@ -299,9 +301,9 @@ static struct nf_hook_entries __rcu **nf + } + + #ifdef CONFIG_NETFILTER_INGRESS +- if (reg->hooknum == NF_NETDEV_INGRESS) { +- if (reg->dev && dev_net(reg->dev) == net) +- return ®->dev->nf_hooks_ingress; ++ if (hooknum == NF_NETDEV_INGRESS) { ++ if (dev && dev_net(dev) == net) ++ return &dev->nf_hooks_ingress; + } + #endif + WARN_ON_ONCE(1); +@@ -323,7 +325,7 @@ int nf_register_net_hook(struct net *net + return -EINVAL; + } + +- pp = nf_hook_entry_head(net, reg); ++ pp = nf_hook_entry_head(net, reg->pf, reg->hooknum, reg->dev); + if (!pp) + return -EINVAL; + +@@ -397,7 +399,7 @@ void nf_unregister_net_hook(struct net * + struct nf_hook_entries __rcu **pp; + struct nf_hook_entries *p; + +- pp = nf_hook_entry_head(net, reg); ++ pp = nf_hook_entry_head(net, reg->pf, reg->hooknum, reg->dev); + if (!pp) + return; + diff --git a/target/linux/generic/backport-4.19/298-v4.16-netfilter-core-add-nf_remove_net_hook.patch b/target/linux/generic/backport-4.19/298-v4.16-netfilter-core-add-nf_remove_net_hook.patch new file mode 100644 index 0000000000..8fea44b359 --- /dev/null +++ b/target/linux/generic/backport-4.19/298-v4.16-netfilter-core-add-nf_remove_net_hook.patch @@ -0,0 +1,44 @@ +From 3d3cdc38e8c265a9f9d3825e823e772872bca1b8 Mon Sep 17 00:00:00 2001 +From: Pablo Neira Ayuso <pablo@netfilter.org> +Date: Sat, 9 Dec 2017 15:19:14 +0100 +Subject: [PATCH 01/11] netfilter: core: add nf_remove_net_hook + +Just a cleanup, __nf_unregister_net_hook() is used by a follow up patch +when handling NFPROTO_INET as a real family from the core. + +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + net/netfilter/core.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/net/netfilter/core.c ++++ b/net/netfilter/core.c +@@ -356,7 +356,7 @@ int nf_register_net_hook(struct net *net + EXPORT_SYMBOL(nf_register_net_hook); + + /* +- * __nf_unregister_net_hook - remove a hook from blob ++ * nf_remove_net_hook - remove a hook from blob + * + * @oldp: current address of hook blob + * @unreg: hook to unregister +@@ -364,8 +364,8 @@ EXPORT_SYMBOL(nf_register_net_hook); + * This cannot fail, hook unregistration must always succeed. + * Therefore replace the to-be-removed hook with a dummy hook. + */ +-static void __nf_unregister_net_hook(struct nf_hook_entries *old, +- const struct nf_hook_ops *unreg) ++static void nf_remove_net_hook(struct nf_hook_entries *old, ++ const struct nf_hook_ops *unreg) + { + struct nf_hook_ops **orig_ops; + bool found = false; +@@ -411,7 +411,7 @@ void nf_unregister_net_hook(struct net * + return; + } + +- __nf_unregister_net_hook(p, reg); ++ nf_remove_net_hook(p, reg); + + p = __nf_hook_entries_try_shrink(pp); + mutex_unlock(&nf_hook_mutex); diff --git a/target/linux/generic/backport-4.19/298-v4.16-netfilter-core-pass-family-as-parameter-to-nf_remove.patch b/target/linux/generic/backport-4.19/298-v4.16-netfilter-core-pass-family-as-parameter-to-nf_remove.patch new file mode 100644 index 0000000000..4c52635c13 --- /dev/null +++ b/target/linux/generic/backport-4.19/298-v4.16-netfilter-core-pass-family-as-parameter-to-nf_remove.patch @@ -0,0 +1,51 @@ +From 30259408118f550f5969fda19c0d67020d21eda8 Mon Sep 17 00:00:00 2001 +From: Pablo Neira Ayuso <pablo@netfilter.org> +Date: Sat, 9 Dec 2017 15:26:37 +0100 +Subject: [PATCH 10/11] netfilter: core: pass family as parameter to + nf_remove_net_hook() + +So static_key_slow_dec applies to the family behind NFPROTO_INET. + +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + net/netfilter/core.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/net/netfilter/core.c ++++ b/net/netfilter/core.c +@@ -365,7 +365,7 @@ EXPORT_SYMBOL(nf_register_net_hook); + * Therefore replace the to-be-removed hook with a dummy hook. + */ + static void nf_remove_net_hook(struct nf_hook_entries *old, +- const struct nf_hook_ops *unreg) ++ const struct nf_hook_ops *unreg, int pf) + { + struct nf_hook_ops **orig_ops; + bool found = false; +@@ -383,14 +383,14 @@ static void nf_remove_net_hook(struct nf + + if (found) { + #ifdef CONFIG_NETFILTER_INGRESS +- if (unreg->pf == NFPROTO_NETDEV && unreg->hooknum == NF_NETDEV_INGRESS) ++ if (pf == NFPROTO_NETDEV && unreg->hooknum == NF_NETDEV_INGRESS) + net_dec_ingress_queue(); + #endif + #ifdef HAVE_JUMP_LABEL +- static_key_slow_dec(&nf_hooks_needed[unreg->pf][unreg->hooknum]); ++ static_key_slow_dec(&nf_hooks_needed[pf][unreg->hooknum]); + #endif + } else { +- WARN_ONCE(1, "hook not found, pf %d num %d", unreg->pf, unreg->hooknum); ++ WARN_ONCE(1, "hook not found, pf %d num %d", pf, unreg->hooknum); + } + } + +@@ -411,7 +411,7 @@ void nf_unregister_net_hook(struct net * + return; + } + +- nf_remove_net_hook(p, reg); ++ nf_remove_net_hook(p, reg, reg->pf); + + p = __nf_hook_entries_try_shrink(pp); + mutex_unlock(&nf_hook_mutex); diff --git a/target/linux/generic/backport-4.19/299-v4.16-netfilter-core-support-for-NFPROTO_INET-hook-registr.patch b/target/linux/generic/backport-4.19/299-v4.16-netfilter-core-support-for-NFPROTO_INET-hook-registr.patch new file mode 100644 index 0000000000..b112855132 --- /dev/null +++ b/target/linux/generic/backport-4.19/299-v4.16-netfilter-core-support-for-NFPROTO_INET-hook-registr.patch @@ -0,0 +1,129 @@ +From cb7ccd835ebb333669e400f99c650e4f3abf11c0 Mon Sep 17 00:00:00 2001 +From: Pablo Neira Ayuso <pablo@netfilter.org> +Date: Sat, 9 Dec 2017 15:30:26 +0100 +Subject: [PATCH 11/11] netfilter: core: support for NFPROTO_INET hook + registration + +Expand NFPROTO_INET in two hook registrations, one for NFPROTO_IPV4 and +another for NFPROTO_IPV6. Hence, we handle NFPROTO_INET from the core. + +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + net/netfilter/core.c | 53 +++++++++++++++++++++++++++++++++++++++++++--------- + 1 file changed, 44 insertions(+), 9 deletions(-) + +--- a/net/netfilter/core.c ++++ b/net/netfilter/core.c +@@ -310,12 +310,13 @@ nf_hook_entry_head(struct net *net, int + return NULL; + } + +-int nf_register_net_hook(struct net *net, const struct nf_hook_ops *reg) ++static int __nf_register_net_hook(struct net *net, int pf, ++ const struct nf_hook_ops *reg) + { + struct nf_hook_entries *p, *new_hooks; + struct nf_hook_entries __rcu **pp; + +- if (reg->pf == NFPROTO_NETDEV) { ++ if (pf == NFPROTO_NETDEV) { + #ifndef CONFIG_NETFILTER_INGRESS + if (reg->hooknum == NF_NETDEV_INGRESS) + return -EOPNOTSUPP; +@@ -325,7 +326,7 @@ int nf_register_net_hook(struct net *net + return -EINVAL; + } + +- pp = nf_hook_entry_head(net, reg->pf, reg->hooknum, reg->dev); ++ pp = nf_hook_entry_head(net, pf, reg->hooknum, reg->dev); + if (!pp) + return -EINVAL; + +@@ -343,17 +344,16 @@ int nf_register_net_hook(struct net *net + + hooks_validate(new_hooks); + #ifdef CONFIG_NETFILTER_INGRESS +- if (reg->pf == NFPROTO_NETDEV && reg->hooknum == NF_NETDEV_INGRESS) ++ if (pf == NFPROTO_NETDEV && reg->hooknum == NF_NETDEV_INGRESS) + net_inc_ingress_queue(); + #endif + #ifdef HAVE_JUMP_LABEL +- static_key_slow_inc(&nf_hooks_needed[reg->pf][reg->hooknum]); ++ static_key_slow_inc(&nf_hooks_needed[pf][reg->hooknum]); + #endif + BUG_ON(p == new_hooks); + nf_hook_entries_free(p); + return 0; + } +-EXPORT_SYMBOL(nf_register_net_hook); + + /* + * nf_remove_net_hook - remove a hook from blob +@@ -394,12 +394,13 @@ static void nf_remove_net_hook(struct nf + } + } + +-void nf_unregister_net_hook(struct net *net, const struct nf_hook_ops *reg) ++void __nf_unregister_net_hook(struct net *net, int pf, ++ const struct nf_hook_ops *reg) + { + struct nf_hook_entries __rcu **pp; + struct nf_hook_entries *p; + +- pp = nf_hook_entry_head(net, reg->pf, reg->hooknum, reg->dev); ++ pp = nf_hook_entry_head(net, pf, reg->hooknum, reg->dev); + if (!pp) + return; + +@@ -411,7 +412,7 @@ void nf_unregister_net_hook(struct net * + return; + } + +- nf_remove_net_hook(p, reg, reg->pf); ++ nf_remove_net_hook(p, reg, pf); + + p = __nf_hook_entries_try_shrink(pp); + mutex_unlock(&nf_hook_mutex); +@@ -421,8 +422,42 @@ void nf_unregister_net_hook(struct net * + nf_queue_nf_hook_drop(net); + nf_hook_entries_free(p); + } ++ ++void nf_unregister_net_hook(struct net *net, const struct nf_hook_ops *reg) ++{ ++ if (reg->pf == NFPROTO_INET) { ++ __nf_unregister_net_hook(net, NFPROTO_IPV4, reg); ++ __nf_unregister_net_hook(net, NFPROTO_IPV6, reg); ++ } else { ++ __nf_unregister_net_hook(net, reg->pf, reg); ++ } ++} + EXPORT_SYMBOL(nf_unregister_net_hook); + ++int nf_register_net_hook(struct net *net, const struct nf_hook_ops *reg) ++{ ++ int err; ++ ++ if (reg->pf == NFPROTO_INET) { ++ err = __nf_register_net_hook(net, NFPROTO_IPV4, reg); ++ if (err < 0) ++ return err; ++ ++ err = __nf_register_net_hook(net, NFPROTO_IPV6, reg); ++ if (err < 0) { ++ __nf_unregister_net_hook(net, NFPROTO_IPV4, reg); ++ return err; ++ } ++ } else { ++ err = __nf_register_net_hook(net, reg->pf, reg); ++ if (err < 0) ++ return err; ++ } ++ ++ return 0; ++} ++EXPORT_SYMBOL(nf_register_net_hook); ++ + int nf_register_net_hooks(struct net *net, const struct nf_hook_ops *reg, + unsigned int n) + { diff --git a/target/linux/generic/backport-4.19/300-v4.16-netfilter-nf_tables-explicit-nft_set_pktinfo-call-fr.patch b/target/linux/generic/backport-4.19/300-v4.16-netfilter-nf_tables-explicit-nft_set_pktinfo-call-fr.patch new file mode 100644 index 0000000000..c0cb5bbeba --- /dev/null +++ b/target/linux/generic/backport-4.19/300-v4.16-netfilter-nf_tables-explicit-nft_set_pktinfo-call-fr.patch @@ -0,0 +1,291 @@ +From: Pablo Neira Ayuso <pablo@netfilter.org> +Date: Sun, 10 Dec 2017 01:43:14 +0100 +Subject: [PATCH] netfilter: nf_tables: explicit nft_set_pktinfo() call from + hook path + +Instead of calling this function from the family specific variant, this +reduces the code size in the fast path for the netdev, bridge and inet +families. After this change, we must call nft_set_pktinfo() upfront from +the chain hook indirection. + +Before: + + text data bss dec hex filename + 2145 208 0 2353 931 net/netfilter/nf_tables_netdev.o + +After: + + text data bss dec hex filename + 2125 208 0 2333 91d net/netfilter/nf_tables_netdev.o + +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + +--- a/include/net/netfilter/nf_tables.h ++++ b/include/net/netfilter/nf_tables.h +@@ -54,8 +54,8 @@ static inline void nft_set_pktinfo(struc + pkt->xt.state = state; + } + +-static inline void nft_set_pktinfo_proto_unspec(struct nft_pktinfo *pkt, +- struct sk_buff *skb) ++static inline void nft_set_pktinfo_unspec(struct nft_pktinfo *pkt, ++ struct sk_buff *skb) + { + pkt->tprot_set = false; + pkt->tprot = 0; +@@ -63,14 +63,6 @@ static inline void nft_set_pktinfo_proto + pkt->xt.fragoff = 0; + } + +-static inline void nft_set_pktinfo_unspec(struct nft_pktinfo *pkt, +- struct sk_buff *skb, +- const struct nf_hook_state *state) +-{ +- nft_set_pktinfo(pkt, skb, state); +- nft_set_pktinfo_proto_unspec(pkt, skb); +-} +- + /** + * struct nft_verdict - nf_tables verdict + * +--- a/include/net/netfilter/nf_tables_ipv4.h ++++ b/include/net/netfilter/nf_tables_ipv4.h +@@ -5,15 +5,11 @@ + #include <net/netfilter/nf_tables.h> + #include <net/ip.h> + +-static inline void +-nft_set_pktinfo_ipv4(struct nft_pktinfo *pkt, +- struct sk_buff *skb, +- const struct nf_hook_state *state) ++static inline void nft_set_pktinfo_ipv4(struct nft_pktinfo *pkt, ++ struct sk_buff *skb) + { + struct iphdr *ip; + +- nft_set_pktinfo(pkt, skb, state); +- + ip = ip_hdr(pkt->skb); + pkt->tprot_set = true; + pkt->tprot = ip->protocol; +@@ -21,10 +17,8 @@ nft_set_pktinfo_ipv4(struct nft_pktinfo + pkt->xt.fragoff = ntohs(ip->frag_off) & IP_OFFSET; + } + +-static inline int +-__nft_set_pktinfo_ipv4_validate(struct nft_pktinfo *pkt, +- struct sk_buff *skb, +- const struct nf_hook_state *state) ++static inline int __nft_set_pktinfo_ipv4_validate(struct nft_pktinfo *pkt, ++ struct sk_buff *skb) + { + struct iphdr *iph, _iph; + u32 len, thoff; +@@ -52,14 +46,11 @@ __nft_set_pktinfo_ipv4_validate(struct n + return 0; + } + +-static inline void +-nft_set_pktinfo_ipv4_validate(struct nft_pktinfo *pkt, +- struct sk_buff *skb, +- const struct nf_hook_state *state) ++static inline void nft_set_pktinfo_ipv4_validate(struct nft_pktinfo *pkt, ++ struct sk_buff *skb) + { +- nft_set_pktinfo(pkt, skb, state); +- if (__nft_set_pktinfo_ipv4_validate(pkt, skb, state) < 0) +- nft_set_pktinfo_proto_unspec(pkt, skb); ++ if (__nft_set_pktinfo_ipv4_validate(pkt, skb) < 0) ++ nft_set_pktinfo_unspec(pkt, skb); + } + + extern struct nft_af_info nft_af_ipv4; +--- a/include/net/netfilter/nf_tables_ipv6.h ++++ b/include/net/netfilter/nf_tables_ipv6.h +@@ -5,20 +5,16 @@ + #include <linux/netfilter_ipv6/ip6_tables.h> + #include <net/ipv6.h> + +-static inline void +-nft_set_pktinfo_ipv6(struct nft_pktinfo *pkt, +- struct sk_buff *skb, +- const struct nf_hook_state *state) ++static inline void nft_set_pktinfo_ipv6(struct nft_pktinfo *pkt, ++ struct sk_buff *skb) + { + unsigned int flags = IP6_FH_F_AUTH; + int protohdr, thoff = 0; + unsigned short frag_off; + +- nft_set_pktinfo(pkt, skb, state); +- + protohdr = ipv6_find_hdr(pkt->skb, &thoff, -1, &frag_off, &flags); + if (protohdr < 0) { +- nft_set_pktinfo_proto_unspec(pkt, skb); ++ nft_set_pktinfo_unspec(pkt, skb); + return; + } + +@@ -28,10 +24,8 @@ nft_set_pktinfo_ipv6(struct nft_pktinfo + pkt->xt.fragoff = frag_off; + } + +-static inline int +-__nft_set_pktinfo_ipv6_validate(struct nft_pktinfo *pkt, +- struct sk_buff *skb, +- const struct nf_hook_state *state) ++static inline int __nft_set_pktinfo_ipv6_validate(struct nft_pktinfo *pkt, ++ struct sk_buff *skb) + { + #if IS_ENABLED(CONFIG_IPV6) + unsigned int flags = IP6_FH_F_AUTH; +@@ -68,14 +62,11 @@ __nft_set_pktinfo_ipv6_validate(struct n + #endif + } + +-static inline void +-nft_set_pktinfo_ipv6_validate(struct nft_pktinfo *pkt, +- struct sk_buff *skb, +- const struct nf_hook_state *state) ++static inline void nft_set_pktinfo_ipv6_validate(struct nft_pktinfo *pkt, ++ struct sk_buff *skb) + { +- nft_set_pktinfo(pkt, skb, state); +- if (__nft_set_pktinfo_ipv6_validate(pkt, skb, state) < 0) +- nft_set_pktinfo_proto_unspec(pkt, skb); ++ if (__nft_set_pktinfo_ipv6_validate(pkt, skb) < 0) ++ nft_set_pktinfo_unspec(pkt, skb); + } + + extern struct nft_af_info nft_af_ipv6; +--- a/net/bridge/netfilter/nf_tables_bridge.c ++++ b/net/bridge/netfilter/nf_tables_bridge.c +@@ -25,15 +25,17 @@ nft_do_chain_bridge(void *priv, + { + struct nft_pktinfo pkt; + ++ nft_set_pktinfo(&pkt, skb, state); ++ + switch (eth_hdr(skb)->h_proto) { + case htons(ETH_P_IP): +- nft_set_pktinfo_ipv4_validate(&pkt, skb, state); ++ nft_set_pktinfo_ipv4_validate(&pkt, skb); + break; + case htons(ETH_P_IPV6): +- nft_set_pktinfo_ipv6_validate(&pkt, skb, state); ++ nft_set_pktinfo_ipv6_validate(&pkt, skb); + break; + default: +- nft_set_pktinfo_unspec(&pkt, skb, state); ++ nft_set_pktinfo_unspec(&pkt, skb); + break; + } + +--- a/net/ipv4/netfilter/nf_tables_arp.c ++++ b/net/ipv4/netfilter/nf_tables_arp.c +@@ -21,7 +21,8 @@ nft_do_chain_arp(void *priv, + { + struct nft_pktinfo pkt; + +- nft_set_pktinfo_unspec(&pkt, skb, state); ++ nft_set_pktinfo(&pkt, skb, state); ++ nft_set_pktinfo_unspec(&pkt, skb); + + return nft_do_chain(&pkt, priv); + } +--- a/net/ipv4/netfilter/nf_tables_ipv4.c ++++ b/net/ipv4/netfilter/nf_tables_ipv4.c +@@ -24,7 +24,8 @@ static unsigned int nft_do_chain_ipv4(vo + { + struct nft_pktinfo pkt; + +- nft_set_pktinfo_ipv4(&pkt, skb, state); ++ nft_set_pktinfo(&pkt, skb, state); ++ nft_set_pktinfo_ipv4(&pkt, skb); + + return nft_do_chain(&pkt, priv); + } +--- a/net/ipv4/netfilter/nft_chain_nat_ipv4.c ++++ b/net/ipv4/netfilter/nft_chain_nat_ipv4.c +@@ -33,7 +33,8 @@ static unsigned int nft_nat_do_chain(voi + { + struct nft_pktinfo pkt; + +- nft_set_pktinfo_ipv4(&pkt, skb, state); ++ nft_set_pktinfo(&pkt, skb, state); ++ nft_set_pktinfo_ipv4(&pkt, skb); + + return nft_do_chain(&pkt, priv); + } +--- a/net/ipv4/netfilter/nft_chain_route_ipv4.c ++++ b/net/ipv4/netfilter/nft_chain_route_ipv4.c +@@ -38,7 +38,8 @@ static unsigned int nf_route_table_hook( + ip_hdrlen(skb) < sizeof(struct iphdr)) + return NF_ACCEPT; + +- nft_set_pktinfo_ipv4(&pkt, skb, state); ++ nft_set_pktinfo(&pkt, skb, state); ++ nft_set_pktinfo_ipv4(&pkt, skb); + + mark = skb->mark; + iph = ip_hdr(skb); +--- a/net/ipv6/netfilter/nf_tables_ipv6.c ++++ b/net/ipv6/netfilter/nf_tables_ipv6.c +@@ -22,7 +22,8 @@ static unsigned int nft_do_chain_ipv6(vo + { + struct nft_pktinfo pkt; + +- nft_set_pktinfo_ipv6(&pkt, skb, state); ++ nft_set_pktinfo(&pkt, skb, state); ++ nft_set_pktinfo_ipv6(&pkt, skb); + + return nft_do_chain(&pkt, priv); + } +--- a/net/ipv6/netfilter/nft_chain_nat_ipv6.c ++++ b/net/ipv6/netfilter/nft_chain_nat_ipv6.c +@@ -31,7 +31,8 @@ static unsigned int nft_nat_do_chain(voi + { + struct nft_pktinfo pkt; + +- nft_set_pktinfo_ipv6(&pkt, skb, state); ++ nft_set_pktinfo(&pkt, skb, state); ++ nft_set_pktinfo_ipv6(&pkt, skb); + + return nft_do_chain(&pkt, priv); + } +--- a/net/ipv6/netfilter/nft_chain_route_ipv6.c ++++ b/net/ipv6/netfilter/nft_chain_route_ipv6.c +@@ -33,7 +33,8 @@ static unsigned int nf_route_table_hook( + u32 mark, flowlabel; + int err; + +- nft_set_pktinfo_ipv6(&pkt, skb, state); ++ nft_set_pktinfo(&pkt, skb, state); ++ nft_set_pktinfo_ipv6(&pkt, skb); + + /* save source/dest address, mark, hoplimit, flowlabel, priority */ + memcpy(&saddr, &ipv6_hdr(skb)->saddr, sizeof(saddr)); +--- a/net/netfilter/nf_tables_netdev.c ++++ b/net/netfilter/nf_tables_netdev.c +@@ -21,15 +21,17 @@ nft_do_chain_netdev(void *priv, struct s + { + struct nft_pktinfo pkt; + ++ nft_set_pktinfo(&pkt, skb, state); ++ + switch (skb->protocol) { + case htons(ETH_P_IP): +- nft_set_pktinfo_ipv4_validate(&pkt, skb, state); ++ nft_set_pktinfo_ipv4_validate(&pkt, skb); + break; + case htons(ETH_P_IPV6): +- nft_set_pktinfo_ipv6_validate(&pkt, skb, state); ++ nft_set_pktinfo_ipv6_validate(&pkt, skb); + break; + default: +- nft_set_pktinfo_unspec(&pkt, skb, state); ++ nft_set_pktinfo_unspec(&pkt, skb); + break; + } + diff --git a/target/linux/generic/backport-4.19/301-v4.16-netfilter-core-only-allow-one-nat-hook-per-hook-poin.patch b/target/linux/generic/backport-4.19/301-v4.16-netfilter-core-only-allow-one-nat-hook-per-hook-poin.patch new file mode 100644 index 0000000000..05888a070e --- /dev/null +++ b/target/linux/generic/backport-4.19/301-v4.16-netfilter-core-only-allow-one-nat-hook-per-hook-poin.patch @@ -0,0 +1,146 @@ +From: Florian Westphal <fw@strlen.de> +Date: Fri, 8 Dec 2017 17:01:54 +0100 +Subject: [PATCH] netfilter: core: only allow one nat hook per hook point + +The netfilter NAT core cannot deal with more than one NAT hook per hook +location (prerouting, input ...), because the NAT hooks install a NAT null +binding in case the iptables nat table (iptable_nat hooks) or the +corresponding nftables chain (nft nat hooks) doesn't specify a nat +transformation. + +Null bindings are needed to detect port collsisions between NAT-ed and +non-NAT-ed connections. + +This causes nftables NAT rules to not work when iptable_nat module is +loaded, and vice versa because nat binding has already been attached +when the second nat hook is consulted. + +The netfilter core is not really the correct location to handle this +(hooks are just hooks, the core has no notion of what kinds of side + effects a hook implements), but its the only place where we can check +for conflicts between both iptables hooks and nftables hooks without +adding dependencies. + +So add nat annotation to hook_ops to describe those hooks that will +add NAT bindings and then make core reject if such a hook already exists. +The annotation fills a padding hole, in case further restrictions appar +we might change this to a 'u8 type' instead of bool. + +iptables error if nft nat hook active: +iptables -t nat -A POSTROUTING -j MASQUERADE +iptables v1.4.21: can't initialize iptables table `nat': File exists +Perhaps iptables or your kernel needs to be upgraded. + +nftables error if iptables nat table present: +nft -f /etc/nftables/ipv4-nat +/usr/etc/nftables/ipv4-nat:3:1-2: Error: Could not process rule: File exists +table nat { +^^ + +Signed-off-by: Florian Westphal <fw@strlen.de> +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + +--- a/include/linux/netfilter.h ++++ b/include/linux/netfilter.h +@@ -67,6 +67,7 @@ struct nf_hook_ops { + struct net_device *dev; + void *priv; + u_int8_t pf; ++ bool nat_hook; + unsigned int hooknum; + /* Hooks are ordered in ascending priority. */ + int priority; +--- a/net/ipv4/netfilter/iptable_nat.c ++++ b/net/ipv4/netfilter/iptable_nat.c +@@ -72,6 +72,7 @@ static const struct nf_hook_ops nf_nat_i + { + .hook = iptable_nat_ipv4_in, + .pf = NFPROTO_IPV4, ++ .nat_hook = true, + .hooknum = NF_INET_PRE_ROUTING, + .priority = NF_IP_PRI_NAT_DST, + }, +@@ -79,6 +80,7 @@ static const struct nf_hook_ops nf_nat_i + { + .hook = iptable_nat_ipv4_out, + .pf = NFPROTO_IPV4, ++ .nat_hook = true, + .hooknum = NF_INET_POST_ROUTING, + .priority = NF_IP_PRI_NAT_SRC, + }, +@@ -86,6 +88,7 @@ static const struct nf_hook_ops nf_nat_i + { + .hook = iptable_nat_ipv4_local_fn, + .pf = NFPROTO_IPV4, ++ .nat_hook = true, + .hooknum = NF_INET_LOCAL_OUT, + .priority = NF_IP_PRI_NAT_DST, + }, +@@ -93,6 +96,7 @@ static const struct nf_hook_ops nf_nat_i + { + .hook = iptable_nat_ipv4_fn, + .pf = NFPROTO_IPV4, ++ .nat_hook = true, + .hooknum = NF_INET_LOCAL_IN, + .priority = NF_IP_PRI_NAT_SRC, + }, +--- a/net/ipv6/netfilter/ip6table_nat.c ++++ b/net/ipv6/netfilter/ip6table_nat.c +@@ -74,6 +74,7 @@ static const struct nf_hook_ops nf_nat_i + { + .hook = ip6table_nat_in, + .pf = NFPROTO_IPV6, ++ .nat_hook = true, + .hooknum = NF_INET_PRE_ROUTING, + .priority = NF_IP6_PRI_NAT_DST, + }, +@@ -81,6 +82,7 @@ static const struct nf_hook_ops nf_nat_i + { + .hook = ip6table_nat_out, + .pf = NFPROTO_IPV6, ++ .nat_hook = true, + .hooknum = NF_INET_POST_ROUTING, + .priority = NF_IP6_PRI_NAT_SRC, + }, +@@ -88,12 +90,14 @@ static const struct nf_hook_ops nf_nat_i + { + .hook = ip6table_nat_local_fn, + .pf = NFPROTO_IPV6, ++ .nat_hook = true, + .hooknum = NF_INET_LOCAL_OUT, + .priority = NF_IP6_PRI_NAT_DST, + }, + /* After packet filtering, change source */ + { + .hook = ip6table_nat_fn, ++ .nat_hook = true, + .pf = NFPROTO_IPV6, + .hooknum = NF_INET_LOCAL_IN, + .priority = NF_IP6_PRI_NAT_SRC, +--- a/net/netfilter/core.c ++++ b/net/netfilter/core.c +@@ -160,6 +160,12 @@ nf_hook_entries_grow(const struct nf_hoo + ++i; + continue; + } ++ ++ if (reg->nat_hook && orig_ops[i]->nat_hook) { ++ kvfree(new); ++ return ERR_PTR(-EEXIST); ++ } ++ + if (inserted || reg->priority > orig_ops[i]->priority) { + new_ops[nhooks] = (void *)orig_ops[i]; + new->hooks[nhooks] = old->hooks[i]; +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -1431,6 +1431,8 @@ static int nf_tables_addchain(struct nft + ops->hook = hookfn; + if (afi->hook_ops_init) + afi->hook_ops_init(ops, i); ++ if (basechain->type->type == NFT_CHAIN_T_NAT) ++ ops->nat_hook = true; + } + + chain->flags |= NFT_BASE_CHAIN; diff --git a/target/linux/generic/backport-4.19/302-v4.16-netfilter-nf_tables_inet-don-t-use-multihook-infrast.patch b/target/linux/generic/backport-4.19/302-v4.16-netfilter-nf_tables_inet-don-t-use-multihook-infrast.patch new file mode 100644 index 0000000000..17d8b21a0f --- /dev/null +++ b/target/linux/generic/backport-4.19/302-v4.16-netfilter-nf_tables_inet-don-t-use-multihook-infrast.patch @@ -0,0 +1,161 @@ +From: Pablo Neira Ayuso <pablo@netfilter.org> +Date: Sat, 9 Dec 2017 15:36:24 +0100 +Subject: [PATCH] netfilter: nf_tables_inet: don't use multihook infrastructure + anymore + +Use new native NFPROTO_INET support in netfilter core, this gets rid of +ad-hoc code in the nf_tables API codebase. + +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + +--- a/include/net/netfilter/nf_tables_ipv4.h ++++ b/include/net/netfilter/nf_tables_ipv4.h +@@ -53,6 +53,4 @@ static inline void nft_set_pktinfo_ipv4_ + nft_set_pktinfo_unspec(pkt, skb); + } + +-extern struct nft_af_info nft_af_ipv4; +- + #endif +--- a/include/net/netfilter/nf_tables_ipv6.h ++++ b/include/net/netfilter/nf_tables_ipv6.h +@@ -69,6 +69,4 @@ static inline void nft_set_pktinfo_ipv6_ + nft_set_pktinfo_unspec(pkt, skb); + } + +-extern struct nft_af_info nft_af_ipv6; +- + #endif +--- a/net/ipv4/netfilter/nf_tables_ipv4.c ++++ b/net/ipv4/netfilter/nf_tables_ipv4.c +@@ -45,7 +45,7 @@ static unsigned int nft_ipv4_output(void + return nft_do_chain_ipv4(priv, skb, state); + } + +-struct nft_af_info nft_af_ipv4 __read_mostly = { ++static struct nft_af_info nft_af_ipv4 __read_mostly = { + .family = NFPROTO_IPV4, + .nhooks = NF_INET_NUMHOOKS, + .owner = THIS_MODULE, +@@ -58,7 +58,6 @@ struct nft_af_info nft_af_ipv4 __read_mo + [NF_INET_POST_ROUTING] = nft_do_chain_ipv4, + }, + }; +-EXPORT_SYMBOL_GPL(nft_af_ipv4); + + static int nf_tables_ipv4_init_net(struct net *net) + { +--- a/net/ipv6/netfilter/nf_tables_ipv6.c ++++ b/net/ipv6/netfilter/nf_tables_ipv6.c +@@ -42,7 +42,7 @@ static unsigned int nft_ipv6_output(void + return nft_do_chain_ipv6(priv, skb, state); + } + +-struct nft_af_info nft_af_ipv6 __read_mostly = { ++static struct nft_af_info nft_af_ipv6 __read_mostly = { + .family = NFPROTO_IPV6, + .nhooks = NF_INET_NUMHOOKS, + .owner = THIS_MODULE, +@@ -55,7 +55,6 @@ struct nft_af_info nft_af_ipv6 __read_mo + [NF_INET_POST_ROUTING] = nft_do_chain_ipv6, + }, + }; +-EXPORT_SYMBOL_GPL(nft_af_ipv6); + + static int nf_tables_ipv6_init_net(struct net *net) + { +--- a/net/netfilter/nf_tables_inet.c ++++ b/net/netfilter/nf_tables_inet.c +@@ -9,6 +9,7 @@ + #include <linux/init.h> + #include <linux/module.h> + #include <linux/ip.h> ++#include <linux/ipv6.h> + #include <linux/netfilter_ipv4.h> + #include <linux/netfilter_ipv6.h> + #include <net/netfilter/nf_tables.h> +@@ -16,26 +17,71 @@ + #include <net/netfilter/nf_tables_ipv6.h> + #include <net/ip.h> + +-static void nft_inet_hook_ops_init(struct nf_hook_ops *ops, unsigned int n) ++static unsigned int nft_do_chain_inet(void *priv, struct sk_buff *skb, ++ const struct nf_hook_state *state) + { +- struct nft_af_info *afi; ++ struct nft_pktinfo pkt; + +- if (n == 1) +- afi = &nft_af_ipv4; +- else +- afi = &nft_af_ipv6; +- +- ops->pf = afi->family; +- if (afi->hooks[ops->hooknum]) +- ops->hook = afi->hooks[ops->hooknum]; ++ nft_set_pktinfo(&pkt, skb, state); ++ ++ switch (state->pf) { ++ case NFPROTO_IPV4: ++ nft_set_pktinfo_ipv4(&pkt, skb); ++ break; ++ case NFPROTO_IPV6: ++ nft_set_pktinfo_ipv6(&pkt, skb); ++ break; ++ default: ++ break; ++ } ++ ++ return nft_do_chain(&pkt, priv); ++} ++ ++static unsigned int nft_inet_output(void *priv, struct sk_buff *skb, ++ const struct nf_hook_state *state) ++{ ++ struct nft_pktinfo pkt; ++ ++ nft_set_pktinfo(&pkt, skb, state); ++ ++ switch (state->pf) { ++ case NFPROTO_IPV4: ++ if (unlikely(skb->len < sizeof(struct iphdr) || ++ ip_hdr(skb)->ihl < sizeof(struct iphdr) / 4)) { ++ if (net_ratelimit()) ++ pr_info("ignoring short SOCK_RAW packet\n"); ++ return NF_ACCEPT; ++ } ++ nft_set_pktinfo_ipv4(&pkt, skb); ++ break; ++ case NFPROTO_IPV6: ++ if (unlikely(skb->len < sizeof(struct ipv6hdr))) { ++ if (net_ratelimit()) ++ pr_info("ignoring short SOCK_RAW packet\n"); ++ return NF_ACCEPT; ++ } ++ nft_set_pktinfo_ipv6(&pkt, skb); ++ break; ++ default: ++ break; ++ } ++ ++ return nft_do_chain(&pkt, priv); + } + + static struct nft_af_info nft_af_inet __read_mostly = { + .family = NFPROTO_INET, + .nhooks = NF_INET_NUMHOOKS, + .owner = THIS_MODULE, +- .nops = 2, +- .hook_ops_init = nft_inet_hook_ops_init, ++ .nops = 1, ++ .hooks = { ++ [NF_INET_LOCAL_IN] = nft_do_chain_inet, ++ [NF_INET_LOCAL_OUT] = nft_inet_output, ++ [NF_INET_FORWARD] = nft_do_chain_inet, ++ [NF_INET_PRE_ROUTING] = nft_do_chain_inet, ++ [NF_INET_POST_ROUTING] = nft_do_chain_inet, ++ }, + }; + + static int __net_init nf_tables_inet_init_net(struct net *net) diff --git a/target/linux/generic/backport-4.19/303-v4.16-netfilter-nf_tables-remove-multihook-chains-and-fami.patch b/target/linux/generic/backport-4.19/303-v4.16-netfilter-nf_tables-remove-multihook-chains-and-fami.patch new file mode 100644 index 0000000000..0db6262fd9 --- /dev/null +++ b/target/linux/generic/backport-4.19/303-v4.16-netfilter-nf_tables-remove-multihook-chains-and-fami.patch @@ -0,0 +1,390 @@ +From: Pablo Neira Ayuso <pablo@netfilter.org> +Date: Sat, 9 Dec 2017 15:40:25 +0100 +Subject: [PATCH] netfilter: nf_tables: remove multihook chains and families + +Since NFPROTO_INET is handled from the core, we don't need to maintain +extra infrastructure in nf_tables to handle the double hook +registration, one for IPv4 and another for IPv6. + +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + +--- a/include/net/netfilter/nf_tables.h ++++ b/include/net/netfilter/nf_tables.h +@@ -897,8 +897,6 @@ struct nft_stats { + struct u64_stats_sync syncp; + }; + +-#define NFT_HOOK_OPS_MAX 2 +- + /** + * struct nft_base_chain - nf_tables base chain + * +@@ -910,7 +908,7 @@ struct nft_stats { + * @dev_name: device name that this base chain is attached to (if any) + */ + struct nft_base_chain { +- struct nf_hook_ops ops[NFT_HOOK_OPS_MAX]; ++ struct nf_hook_ops ops; + const struct nf_chain_type *type; + u8 policy; + u8 flags; +@@ -971,8 +969,6 @@ enum nft_af_flags { + * @owner: module owner + * @tables: used internally + * @flags: family flags +- * @nops: number of hook ops in this family +- * @hook_ops_init: initialization function for chain hook ops + * @hooks: hookfn overrides for packet validation + */ + struct nft_af_info { +@@ -982,9 +978,6 @@ struct nft_af_info { + struct module *owner; + struct list_head tables; + u32 flags; +- unsigned int nops; +- void (*hook_ops_init)(struct nf_hook_ops *, +- unsigned int); + nf_hookfn *hooks[NF_MAX_HOOKS]; + }; + +--- a/net/bridge/netfilter/nf_tables_bridge.c ++++ b/net/bridge/netfilter/nf_tables_bridge.c +@@ -46,7 +46,6 @@ static struct nft_af_info nft_af_bridge + .family = NFPROTO_BRIDGE, + .nhooks = NF_BR_NUMHOOKS, + .owner = THIS_MODULE, +- .nops = 1, + .hooks = { + [NF_BR_PRE_ROUTING] = nft_do_chain_bridge, + [NF_BR_LOCAL_IN] = nft_do_chain_bridge, +--- a/net/ipv4/netfilter/nf_tables_arp.c ++++ b/net/ipv4/netfilter/nf_tables_arp.c +@@ -31,7 +31,6 @@ static struct nft_af_info nft_af_arp __r + .family = NFPROTO_ARP, + .nhooks = NF_ARP_NUMHOOKS, + .owner = THIS_MODULE, +- .nops = 1, + .hooks = { + [NF_ARP_IN] = nft_do_chain_arp, + [NF_ARP_OUT] = nft_do_chain_arp, +--- a/net/ipv4/netfilter/nf_tables_ipv4.c ++++ b/net/ipv4/netfilter/nf_tables_ipv4.c +@@ -49,7 +49,6 @@ static struct nft_af_info nft_af_ipv4 __ + .family = NFPROTO_IPV4, + .nhooks = NF_INET_NUMHOOKS, + .owner = THIS_MODULE, +- .nops = 1, + .hooks = { + [NF_INET_LOCAL_IN] = nft_do_chain_ipv4, + [NF_INET_LOCAL_OUT] = nft_ipv4_output, +--- a/net/ipv6/netfilter/nf_tables_ipv6.c ++++ b/net/ipv6/netfilter/nf_tables_ipv6.c +@@ -46,7 +46,6 @@ static struct nft_af_info nft_af_ipv6 __ + .family = NFPROTO_IPV6, + .nhooks = NF_INET_NUMHOOKS, + .owner = THIS_MODULE, +- .nops = 1, + .hooks = { + [NF_INET_LOCAL_IN] = nft_do_chain_ipv6, + [NF_INET_LOCAL_OUT] = nft_ipv6_output, +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -139,29 +139,26 @@ static void nft_trans_destroy(struct nft + kfree(trans); + } + +-static int nf_tables_register_hooks(struct net *net, +- const struct nft_table *table, +- struct nft_chain *chain, +- unsigned int hook_nops) ++static int nf_tables_register_hook(struct net *net, ++ const struct nft_table *table, ++ struct nft_chain *chain) + { + if (table->flags & NFT_TABLE_F_DORMANT || + !nft_is_base_chain(chain)) + return 0; + +- return nf_register_net_hooks(net, nft_base_chain(chain)->ops, +- hook_nops); ++ return nf_register_net_hook(net, &nft_base_chain(chain)->ops); + } + +-static void nf_tables_unregister_hooks(struct net *net, +- const struct nft_table *table, +- struct nft_chain *chain, +- unsigned int hook_nops) ++static void nf_tables_unregister_hook(struct net *net, ++ const struct nft_table *table, ++ struct nft_chain *chain) + { + if (table->flags & NFT_TABLE_F_DORMANT || + !nft_is_base_chain(chain)) + return; + +- nf_unregister_net_hooks(net, nft_base_chain(chain)->ops, hook_nops); ++ nf_unregister_net_hook(net, &nft_base_chain(chain)->ops); + } + + static int nft_trans_table_add(struct nft_ctx *ctx, int msg_type) +@@ -624,8 +621,7 @@ static void _nf_tables_table_disable(str + if (cnt && i++ == cnt) + break; + +- nf_unregister_net_hooks(net, nft_base_chain(chain)->ops, +- afi->nops); ++ nf_unregister_net_hook(net, &nft_base_chain(chain)->ops); + } + } + +@@ -642,8 +638,7 @@ static int nf_tables_table_enable(struct + if (!nft_is_base_chain(chain)) + continue; + +- err = nf_register_net_hooks(net, nft_base_chain(chain)->ops, +- afi->nops); ++ err = nf_register_net_hook(net, &nft_base_chain(chain)->ops); + if (err < 0) + goto err; + +@@ -1055,7 +1050,7 @@ static int nf_tables_fill_chain_info(str + + if (nft_is_base_chain(chain)) { + const struct nft_base_chain *basechain = nft_base_chain(chain); +- const struct nf_hook_ops *ops = &basechain->ops[0]; ++ const struct nf_hook_ops *ops = &basechain->ops; + struct nlattr *nest; + + nest = nla_nest_start(skb, NFTA_CHAIN_HOOK); +@@ -1283,8 +1278,8 @@ static void nf_tables_chain_destroy(stru + free_percpu(basechain->stats); + if (basechain->stats) + static_branch_dec(&nft_counters_enabled); +- if (basechain->ops[0].dev != NULL) +- dev_put(basechain->ops[0].dev); ++ if (basechain->ops.dev != NULL) ++ dev_put(basechain->ops.dev); + kfree(chain->name); + kfree(basechain); + } else { +@@ -1380,7 +1375,6 @@ static int nf_tables_addchain(struct nft + struct nft_stats __percpu *stats; + struct net *net = ctx->net; + struct nft_chain *chain; +- unsigned int i; + int err; + + if (table->use == UINT_MAX) +@@ -1419,21 +1413,18 @@ static int nf_tables_addchain(struct nft + basechain->type = hook.type; + chain = &basechain->chain; + +- for (i = 0; i < afi->nops; i++) { +- ops = &basechain->ops[i]; +- ops->pf = family; +- ops->hooknum = hook.num; +- ops->priority = hook.priority; +- ops->priv = chain; +- ops->hook = afi->hooks[ops->hooknum]; +- ops->dev = hook.dev; +- if (hookfn) +- ops->hook = hookfn; +- if (afi->hook_ops_init) +- afi->hook_ops_init(ops, i); +- if (basechain->type->type == NFT_CHAIN_T_NAT) +- ops->nat_hook = true; +- } ++ ops = &basechain->ops; ++ ops->pf = family; ++ ops->hooknum = hook.num; ++ ops->priority = hook.priority; ++ ops->priv = chain; ++ ops->hook = afi->hooks[ops->hooknum]; ++ ops->dev = hook.dev; ++ if (hookfn) ++ ops->hook = hookfn; ++ ++ if (basechain->type->type == NFT_CHAIN_T_NAT) ++ ops->nat_hook = true; + + chain->flags |= NFT_BASE_CHAIN; + basechain->policy = policy; +@@ -1451,7 +1442,7 @@ static int nf_tables_addchain(struct nft + goto err1; + } + +- err = nf_tables_register_hooks(net, table, chain, afi->nops); ++ err = nf_tables_register_hook(net, table, chain); + if (err < 0) + goto err1; + +@@ -1465,7 +1456,7 @@ static int nf_tables_addchain(struct nft + + return 0; + err2: +- nf_tables_unregister_hooks(net, table, chain, afi->nops); ++ nf_tables_unregister_hook(net, table, chain); + err1: + nf_tables_chain_destroy(chain); + +@@ -1478,13 +1469,12 @@ static int nf_tables_updchain(struct nft + const struct nlattr * const *nla = ctx->nla; + struct nft_table *table = ctx->table; + struct nft_chain *chain = ctx->chain; +- struct nft_af_info *afi = ctx->afi; + struct nft_base_chain *basechain; + struct nft_stats *stats = NULL; + struct nft_chain_hook hook; + struct nf_hook_ops *ops; + struct nft_trans *trans; +- int err, i; ++ int err; + + if (nla[NFTA_CHAIN_HOOK]) { + if (!nft_is_base_chain(chain)) +@@ -1501,14 +1491,12 @@ static int nf_tables_updchain(struct nft + return -EBUSY; + } + +- for (i = 0; i < afi->nops; i++) { +- ops = &basechain->ops[i]; +- if (ops->hooknum != hook.num || +- ops->priority != hook.priority || +- ops->dev != hook.dev) { +- nft_chain_release_hook(&hook); +- return -EBUSY; +- } ++ ops = &basechain->ops; ++ if (ops->hooknum != hook.num || ++ ops->priority != hook.priority || ++ ops->dev != hook.dev) { ++ nft_chain_release_hook(&hook); ++ return -EBUSY; + } + nft_chain_release_hook(&hook); + } +@@ -5135,10 +5123,9 @@ static int nf_tables_commit(struct net * + case NFT_MSG_DELCHAIN: + list_del_rcu(&trans->ctx.chain->list); + nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN); +- nf_tables_unregister_hooks(trans->ctx.net, +- trans->ctx.table, +- trans->ctx.chain, +- trans->ctx.afi->nops); ++ nf_tables_unregister_hook(trans->ctx.net, ++ trans->ctx.table, ++ trans->ctx.chain); + break; + case NFT_MSG_NEWRULE: + nft_clear(trans->ctx.net, nft_trans_rule(trans)); +@@ -5275,10 +5262,9 @@ static int nf_tables_abort(struct net *n + } else { + trans->ctx.table->use--; + list_del_rcu(&trans->ctx.chain->list); +- nf_tables_unregister_hooks(trans->ctx.net, +- trans->ctx.table, +- trans->ctx.chain, +- trans->ctx.afi->nops); ++ nf_tables_unregister_hook(trans->ctx.net, ++ trans->ctx.table, ++ trans->ctx.chain); + } + break; + case NFT_MSG_DELCHAIN: +@@ -5381,7 +5367,7 @@ int nft_chain_validate_hooks(const struc + if (nft_is_base_chain(chain)) { + basechain = nft_base_chain(chain); + +- if ((1 << basechain->ops[0].hooknum) & hook_flags) ++ if ((1 << basechain->ops.hooknum) & hook_flags) + return 0; + + return -EOPNOTSUPP; +@@ -5863,8 +5849,7 @@ int __nft_release_basechain(struct nft_c + + BUG_ON(!nft_is_base_chain(ctx->chain)); + +- nf_tables_unregister_hooks(ctx->net, ctx->chain->table, ctx->chain, +- ctx->afi->nops); ++ nf_tables_unregister_hook(ctx->net, ctx->chain->table, ctx->chain); + list_for_each_entry_safe(rule, nr, &ctx->chain->rules, list) { + list_del(&rule->list); + ctx->chain->use--; +@@ -5893,8 +5878,7 @@ static void __nft_release_afinfo(struct + + list_for_each_entry_safe(table, nt, &afi->tables, list) { + list_for_each_entry(chain, &table->chains, list) +- nf_tables_unregister_hooks(net, table, chain, +- afi->nops); ++ nf_tables_unregister_hook(net, table, chain); + /* No packets are walking on these chains anymore. */ + ctx.table = table; + list_for_each_entry(chain, &table->chains, list) { +--- a/net/netfilter/nf_tables_inet.c ++++ b/net/netfilter/nf_tables_inet.c +@@ -74,7 +74,6 @@ static struct nft_af_info nft_af_inet __ + .family = NFPROTO_INET, + .nhooks = NF_INET_NUMHOOKS, + .owner = THIS_MODULE, +- .nops = 1, + .hooks = { + [NF_INET_LOCAL_IN] = nft_do_chain_inet, + [NF_INET_LOCAL_OUT] = nft_inet_output, +--- a/net/netfilter/nf_tables_netdev.c ++++ b/net/netfilter/nf_tables_netdev.c +@@ -43,7 +43,6 @@ static struct nft_af_info nft_af_netdev + .nhooks = NF_NETDEV_NUMHOOKS, + .owner = THIS_MODULE, + .flags = NFT_AF_NEEDS_DEV, +- .nops = 1, + .hooks = { + [NF_NETDEV_INGRESS] = nft_do_chain_netdev, + }, +@@ -98,7 +97,7 @@ static void nft_netdev_event(unsigned lo + __nft_release_basechain(ctx); + break; + case NETDEV_CHANGENAME: +- if (dev->ifindex != basechain->ops[0].dev->ifindex) ++ if (dev->ifindex != basechain->ops.dev->ifindex) + return; + + strncpy(basechain->dev_name, dev->name, IFNAMSIZ); +--- a/net/netfilter/nft_compat.c ++++ b/net/netfilter/nft_compat.c +@@ -186,7 +186,7 @@ nft_target_set_tgchk_param(struct xt_tgc + if (nft_is_base_chain(ctx->chain)) { + const struct nft_base_chain *basechain = + nft_base_chain(ctx->chain); +- const struct nf_hook_ops *ops = &basechain->ops[0]; ++ const struct nf_hook_ops *ops = &basechain->ops; + + par->hook_mask = 1 << ops->hooknum; + } else { +@@ -317,7 +317,7 @@ static int nft_target_validate(const str + if (nft_is_base_chain(ctx->chain)) { + const struct nft_base_chain *basechain = + nft_base_chain(ctx->chain); +- const struct nf_hook_ops *ops = &basechain->ops[0]; ++ const struct nf_hook_ops *ops = &basechain->ops; + + hook_mask = 1 << ops->hooknum; + if (target->hooks && !(hook_mask & target->hooks)) +@@ -414,7 +414,7 @@ nft_match_set_mtchk_param(struct xt_mtch + if (nft_is_base_chain(ctx->chain)) { + const struct nft_base_chain *basechain = + nft_base_chain(ctx->chain); +- const struct nf_hook_ops *ops = &basechain->ops[0]; ++ const struct nf_hook_ops *ops = &basechain->ops; + + par->hook_mask = 1 << ops->hooknum; + } else { +@@ -564,7 +564,7 @@ static int nft_match_validate(const stru + if (nft_is_base_chain(ctx->chain)) { + const struct nft_base_chain *basechain = + nft_base_chain(ctx->chain); +- const struct nf_hook_ops *ops = &basechain->ops[0]; ++ const struct nf_hook_ops *ops = &basechain->ops; + + hook_mask = 1 << ops->hooknum; + if (match->hooks && !(hook_mask & match->hooks)) diff --git a/target/linux/generic/backport-4.19/304-v4.16-netfilter-move-checksum-indirection-to-struct-nf_ipv.patch b/target/linux/generic/backport-4.19/304-v4.16-netfilter-move-checksum-indirection-to-struct-nf_ipv.patch new file mode 100644 index 0000000000..458ddd4172 --- /dev/null +++ b/target/linux/generic/backport-4.19/304-v4.16-netfilter-move-checksum-indirection-to-struct-nf_ipv.patch @@ -0,0 +1,171 @@ +From: Pablo Neira Ayuso <pablo@netfilter.org> +Date: Mon, 27 Nov 2017 21:55:14 +0100 +Subject: [PATCH] netfilter: move checksum indirection to struct nf_ipv6_ops + +We cannot make a direct call to nf_ip6_checksum() because that would +result in autoloading the 'ipv6' module because of symbol dependencies. +Therefore, define checksum indirection in nf_ipv6_ops where this really +belongs to. + +For IPv4, we can indeed make a direct function call, which is faster, +given IPv4 is built-in in the networking code by default. Still, +CONFIG_INET=n and CONFIG_NETFILTER=y is possible, so define empty inline +stub for IPv4 in such case. + +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + create mode 100644 net/netfilter/utils.c + +--- a/include/linux/netfilter.h ++++ b/include/linux/netfilter.h +@@ -311,8 +311,6 @@ struct nf_queue_entry; + + struct nf_afinfo { + unsigned short family; +- __sum16 (*checksum)(struct sk_buff *skb, unsigned int hook, +- unsigned int dataoff, u_int8_t protocol); + __sum16 (*checksum_partial)(struct sk_buff *skb, + unsigned int hook, + unsigned int dataoff, +@@ -333,20 +331,9 @@ static inline const struct nf_afinfo *nf + return rcu_dereference(nf_afinfo[family]); + } + +-static inline __sum16 +-nf_checksum(struct sk_buff *skb, unsigned int hook, unsigned int dataoff, +- u_int8_t protocol, unsigned short family) +-{ +- const struct nf_afinfo *afinfo; +- __sum16 csum = 0; +- +- rcu_read_lock(); +- afinfo = nf_get_afinfo(family); +- if (afinfo) +- csum = afinfo->checksum(skb, hook, dataoff, protocol); +- rcu_read_unlock(); +- return csum; +-} ++__sum16 nf_checksum(struct sk_buff *skb, unsigned int hook, ++ unsigned int dataoff, u_int8_t protocol, ++ unsigned short family); + + static inline __sum16 + nf_checksum_partial(struct sk_buff *skb, unsigned int hook, +--- a/include/linux/netfilter_ipv4.h ++++ b/include/linux/netfilter_ipv4.h +@@ -7,6 +7,16 @@ + #include <uapi/linux/netfilter_ipv4.h> + + int ip_route_me_harder(struct net *net, struct sk_buff *skb, unsigned addr_type); ++ ++#ifdef CONFIG_INET + __sum16 nf_ip_checksum(struct sk_buff *skb, unsigned int hook, + unsigned int dataoff, u_int8_t protocol); ++#else ++static inline __sum16 nf_ip_checksum(struct sk_buff *skb, unsigned int hook, ++ unsigned int dataoff, u_int8_t protocol) ++{ ++ return 0; ++} ++#endif /* CONFIG_INET */ ++ + #endif /*__LINUX_IP_NETFILTER_H*/ +--- a/include/linux/netfilter_ipv6.h ++++ b/include/linux/netfilter_ipv6.h +@@ -19,6 +19,8 @@ struct nf_ipv6_ops { + void (*route_input)(struct sk_buff *skb); + int (*fragment)(struct net *net, struct sock *sk, struct sk_buff *skb, + int (*output)(struct net *, struct sock *, struct sk_buff *)); ++ __sum16 (*checksum)(struct sk_buff *skb, unsigned int hook, ++ unsigned int dataoff, u_int8_t protocol); + }; + + #ifdef CONFIG_NETFILTER +--- a/net/bridge/netfilter/nf_tables_bridge.c ++++ b/net/bridge/netfilter/nf_tables_bridge.c +@@ -106,12 +106,6 @@ static int nf_br_reroute(struct net *net + return 0; + } + +-static __sum16 nf_br_checksum(struct sk_buff *skb, unsigned int hook, +- unsigned int dataoff, u_int8_t protocol) +-{ +- return 0; +-} +- + static __sum16 nf_br_checksum_partial(struct sk_buff *skb, unsigned int hook, + unsigned int dataoff, unsigned int len, + u_int8_t protocol) +@@ -127,7 +121,6 @@ static int nf_br_route(struct net *net, + + static const struct nf_afinfo nf_br_afinfo = { + .family = AF_BRIDGE, +- .checksum = nf_br_checksum, + .checksum_partial = nf_br_checksum_partial, + .route = nf_br_route, + .saveroute = nf_br_saveroute, +--- a/net/ipv4/netfilter.c ++++ b/net/ipv4/netfilter.c +@@ -188,7 +188,6 @@ static int nf_ip_route(struct net *net, + + static const struct nf_afinfo nf_ip_afinfo = { + .family = AF_INET, +- .checksum = nf_ip_checksum, + .checksum_partial = nf_ip_checksum_partial, + .route = nf_ip_route, + .saveroute = nf_ip_saveroute, +--- a/net/ipv6/netfilter.c ++++ b/net/ipv6/netfilter.c +@@ -193,12 +193,12 @@ static __sum16 nf_ip6_checksum_partial(s + static const struct nf_ipv6_ops ipv6ops = { + .chk_addr = ipv6_chk_addr, + .route_input = ip6_route_input, +- .fragment = ip6_fragment ++ .fragment = ip6_fragment, ++ .checksum = nf_ip6_checksum, + }; + + static const struct nf_afinfo nf_ip6_afinfo = { + .family = AF_INET6, +- .checksum = nf_ip6_checksum, + .checksum_partial = nf_ip6_checksum_partial, + .route = nf_ip6_route, + .saveroute = nf_ip6_saveroute, +--- a/net/netfilter/Makefile ++++ b/net/netfilter/Makefile +@@ -1,5 +1,5 @@ + # SPDX-License-Identifier: GPL-2.0 +-netfilter-objs := core.o nf_log.o nf_queue.o nf_sockopt.o ++netfilter-objs := core.o nf_log.o nf_queue.o nf_sockopt.o utils.o + + nf_conntrack-y := nf_conntrack_core.o nf_conntrack_standalone.o nf_conntrack_expect.o nf_conntrack_helper.o nf_conntrack_proto.o nf_conntrack_l3proto_generic.o nf_conntrack_proto_generic.o nf_conntrack_proto_tcp.o nf_conntrack_proto_udp.o nf_conntrack_extend.o nf_conntrack_acct.o nf_conntrack_seqadj.o + nf_conntrack-$(CONFIG_NF_CONNTRACK_TIMEOUT) += nf_conntrack_timeout.o +--- /dev/null ++++ b/net/netfilter/utils.c +@@ -0,0 +1,26 @@ ++#include <linux/kernel.h> ++#include <linux/netfilter.h> ++#include <linux/netfilter_ipv4.h> ++#include <linux/netfilter_ipv6.h> ++ ++__sum16 nf_checksum(struct sk_buff *skb, unsigned int hook, ++ unsigned int dataoff, u_int8_t protocol, ++ unsigned short family) ++{ ++ const struct nf_ipv6_ops *v6ops; ++ __sum16 csum = 0; ++ ++ switch (family) { ++ case AF_INET: ++ csum = nf_ip_checksum(skb, hook, dataoff, protocol); ++ break; ++ case AF_INET6: ++ v6ops = rcu_dereference(nf_ipv6_ops); ++ if (v6ops) ++ csum = v6ops->checksum(skb, hook, dataoff, protocol); ++ break; ++ } ++ ++ return csum; ++} ++EXPORT_SYMBOL_GPL(nf_checksum); diff --git a/target/linux/generic/backport-4.19/305-v4.16-netfilter-move-checksum_partial-indirection-to-struc.patch b/target/linux/generic/backport-4.19/305-v4.16-netfilter-move-checksum_partial-indirection-to-struc.patch new file mode 100644 index 0000000000..19a0aacb45 --- /dev/null +++ b/target/linux/generic/backport-4.19/305-v4.16-netfilter-move-checksum_partial-indirection-to-struc.patch @@ -0,0 +1,204 @@ +From: Pablo Neira Ayuso <pablo@netfilter.org> +Date: Wed, 20 Dec 2017 16:04:18 +0100 +Subject: [PATCH] netfilter: move checksum_partial indirection to struct + nf_ipv6_ops + +We cannot make a direct call to nf_ip6_checksum_partial() because that +would result in autoloading the 'ipv6' module because of symbol +dependencies. Therefore, define checksum_partial indirection in +nf_ipv6_ops where this really belongs to. + +For IPv4, we can indeed make a direct function call, which is faster, +given IPv4 is built-in in the networking code by default. Still, +CONFIG_INET=n and CONFIG_NETFILTER=y is possible, so define empty inline +stub for IPv4 in such case. + +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + +--- a/include/linux/netfilter.h ++++ b/include/linux/netfilter.h +@@ -311,11 +311,6 @@ struct nf_queue_entry; + + struct nf_afinfo { + unsigned short family; +- __sum16 (*checksum_partial)(struct sk_buff *skb, +- unsigned int hook, +- unsigned int dataoff, +- unsigned int len, +- u_int8_t protocol); + int (*route)(struct net *net, struct dst_entry **dst, + struct flowi *fl, bool strict); + void (*saveroute)(const struct sk_buff *skb, +@@ -335,22 +330,9 @@ __sum16 nf_checksum(struct sk_buff *skb, + unsigned int dataoff, u_int8_t protocol, + unsigned short family); + +-static inline __sum16 +-nf_checksum_partial(struct sk_buff *skb, unsigned int hook, +- unsigned int dataoff, unsigned int len, +- u_int8_t protocol, unsigned short family) +-{ +- const struct nf_afinfo *afinfo; +- __sum16 csum = 0; +- +- rcu_read_lock(); +- afinfo = nf_get_afinfo(family); +- if (afinfo) +- csum = afinfo->checksum_partial(skb, hook, dataoff, len, +- protocol); +- rcu_read_unlock(); +- return csum; +-} ++__sum16 nf_checksum_partial(struct sk_buff *skb, unsigned int hook, ++ unsigned int dataoff, unsigned int len, ++ u_int8_t protocol, unsigned short family); + + int nf_register_afinfo(const struct nf_afinfo *afinfo); + void nf_unregister_afinfo(const struct nf_afinfo *afinfo); +--- a/include/linux/netfilter_ipv4.h ++++ b/include/linux/netfilter_ipv4.h +@@ -11,12 +11,23 @@ int ip_route_me_harder(struct net *net, + #ifdef CONFIG_INET + __sum16 nf_ip_checksum(struct sk_buff *skb, unsigned int hook, + unsigned int dataoff, u_int8_t protocol); ++__sum16 nf_ip_checksum_partial(struct sk_buff *skb, unsigned int hook, ++ unsigned int dataoff, unsigned int len, ++ u_int8_t protocol); + #else + static inline __sum16 nf_ip_checksum(struct sk_buff *skb, unsigned int hook, + unsigned int dataoff, u_int8_t protocol) + { + return 0; + } ++static inline __sum16 nf_ip_checksum_partial(struct sk_buff *skb, ++ unsigned int hook, ++ unsigned int dataoff, ++ unsigned int len, ++ u_int8_t protocol) ++{ ++ return 0; ++} + #endif /* CONFIG_INET */ + + #endif /*__LINUX_IP_NETFILTER_H*/ +--- a/include/linux/netfilter_ipv6.h ++++ b/include/linux/netfilter_ipv6.h +@@ -21,6 +21,9 @@ struct nf_ipv6_ops { + int (*output)(struct net *, struct sock *, struct sk_buff *)); + __sum16 (*checksum)(struct sk_buff *skb, unsigned int hook, + unsigned int dataoff, u_int8_t protocol); ++ __sum16 (*checksum_partial)(struct sk_buff *skb, unsigned int hook, ++ unsigned int dataoff, unsigned int len, ++ u_int8_t protocol); + }; + + #ifdef CONFIG_NETFILTER +--- a/net/bridge/netfilter/nf_tables_bridge.c ++++ b/net/bridge/netfilter/nf_tables_bridge.c +@@ -106,13 +106,6 @@ static int nf_br_reroute(struct net *net + return 0; + } + +-static __sum16 nf_br_checksum_partial(struct sk_buff *skb, unsigned int hook, +- unsigned int dataoff, unsigned int len, +- u_int8_t protocol) +-{ +- return 0; +-} +- + static int nf_br_route(struct net *net, struct dst_entry **dst, + struct flowi *fl, bool strict __always_unused) + { +@@ -121,7 +114,6 @@ static int nf_br_route(struct net *net, + + static const struct nf_afinfo nf_br_afinfo = { + .family = AF_BRIDGE, +- .checksum_partial = nf_br_checksum_partial, + .route = nf_br_route, + .saveroute = nf_br_saveroute, + .reroute = nf_br_reroute, +--- a/net/ipv4/netfilter.c ++++ b/net/ipv4/netfilter.c +@@ -155,9 +155,9 @@ __sum16 nf_ip_checksum(struct sk_buff *s + } + EXPORT_SYMBOL(nf_ip_checksum); + +-static __sum16 nf_ip_checksum_partial(struct sk_buff *skb, unsigned int hook, +- unsigned int dataoff, unsigned int len, +- u_int8_t protocol) ++__sum16 nf_ip_checksum_partial(struct sk_buff *skb, unsigned int hook, ++ unsigned int dataoff, unsigned int len, ++ u_int8_t protocol) + { + const struct iphdr *iph = ip_hdr(skb); + __sum16 csum = 0; +@@ -175,6 +175,7 @@ static __sum16 nf_ip_checksum_partial(st + } + return csum; + } ++EXPORT_SYMBOL_GPL(nf_ip_checksum_partial); + + static int nf_ip_route(struct net *net, struct dst_entry **dst, + struct flowi *fl, bool strict __always_unused) +@@ -188,7 +189,6 @@ static int nf_ip_route(struct net *net, + + static const struct nf_afinfo nf_ip_afinfo = { + .family = AF_INET, +- .checksum_partial = nf_ip_checksum_partial, + .route = nf_ip_route, + .saveroute = nf_ip_saveroute, + .reroute = nf_ip_reroute, +--- a/net/ipv6/netfilter.c ++++ b/net/ipv6/netfilter.c +@@ -191,15 +191,15 @@ static __sum16 nf_ip6_checksum_partial(s + }; + + static const struct nf_ipv6_ops ipv6ops = { +- .chk_addr = ipv6_chk_addr, +- .route_input = ip6_route_input, +- .fragment = ip6_fragment, +- .checksum = nf_ip6_checksum, ++ .chk_addr = ipv6_chk_addr, ++ .route_input = ip6_route_input, ++ .fragment = ip6_fragment, ++ .checksum = nf_ip6_checksum, ++ .checksum_partial = nf_ip6_checksum_partial, + }; + + static const struct nf_afinfo nf_ip6_afinfo = { + .family = AF_INET6, +- .checksum_partial = nf_ip6_checksum_partial, + .route = nf_ip6_route, + .saveroute = nf_ip6_saveroute, + .reroute = nf_ip6_reroute, +--- a/net/netfilter/utils.c ++++ b/net/netfilter/utils.c +@@ -24,3 +24,27 @@ __sum16 nf_checksum(struct sk_buff *skb, + return csum; + } + EXPORT_SYMBOL_GPL(nf_checksum); ++ ++__sum16 nf_checksum_partial(struct sk_buff *skb, unsigned int hook, ++ unsigned int dataoff, unsigned int len, ++ u_int8_t protocol, unsigned short family) ++{ ++ const struct nf_ipv6_ops *v6ops; ++ __sum16 csum = 0; ++ ++ switch (family) { ++ case AF_INET: ++ csum = nf_ip_checksum_partial(skb, hook, dataoff, len, ++ protocol); ++ break; ++ case AF_INET6: ++ v6ops = rcu_dereference(nf_ipv6_ops); ++ if (v6ops) ++ csum = v6ops->checksum_partial(skb, hook, dataoff, len, ++ protocol); ++ break; ++ } ++ ++ return csum; ++} ++EXPORT_SYMBOL_GPL(nf_checksum_partial); diff --git a/target/linux/generic/backport-4.19/306-v4.16-netfilter-remove-saveroute-indirection-in-struct-nf_.patch b/target/linux/generic/backport-4.19/306-v4.16-netfilter-remove-saveroute-indirection-in-struct-nf_.patch new file mode 100644 index 0000000000..75de3c84fe --- /dev/null +++ b/target/linux/generic/backport-4.19/306-v4.16-netfilter-remove-saveroute-indirection-in-struct-nf_.patch @@ -0,0 +1,232 @@ +From: Pablo Neira Ayuso <pablo@netfilter.org> +Date: Wed, 20 Dec 2017 16:12:55 +0100 +Subject: [PATCH] netfilter: remove saveroute indirection in struct nf_afinfo + +This is only used by nf_queue.c and this function comes with no symbol +dependencies with IPv6, it just refers to structure layouts. Therefore, +we can replace it by a direct function call from where it belongs. + +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + +--- a/include/linux/netfilter.h ++++ b/include/linux/netfilter.h +@@ -313,8 +313,6 @@ struct nf_afinfo { + unsigned short family; + int (*route)(struct net *net, struct dst_entry **dst, + struct flowi *fl, bool strict); +- void (*saveroute)(const struct sk_buff *skb, +- struct nf_queue_entry *entry); + int (*reroute)(struct net *net, struct sk_buff *skb, + const struct nf_queue_entry *entry); + int route_key_size; +--- a/include/linux/netfilter_ipv4.h ++++ b/include/linux/netfilter_ipv4.h +@@ -6,6 +6,16 @@ + + #include <uapi/linux/netfilter_ipv4.h> + ++/* Extra routing may needed on local out, as the QUEUE target never returns ++ * control to the table. ++ */ ++struct ip_rt_info { ++ __be32 daddr; ++ __be32 saddr; ++ u_int8_t tos; ++ u_int32_t mark; ++}; ++ + int ip_route_me_harder(struct net *net, struct sk_buff *skb, unsigned addr_type); + + #ifdef CONFIG_INET +--- a/include/linux/netfilter_ipv6.h ++++ b/include/linux/netfilter_ipv6.h +@@ -9,6 +9,15 @@ + + #include <uapi/linux/netfilter_ipv6.h> + ++/* Extra routing may needed on local out, as the QUEUE target never returns ++ * control to the table. ++ */ ++struct ip6_rt_info { ++ struct in6_addr daddr; ++ struct in6_addr saddr; ++ u_int32_t mark; ++}; ++ + /* + * Hook functions for ipv6 to allow xt_* modules to be built-in even + * if IPv6 is a module. +--- a/net/bridge/netfilter/nf_tables_bridge.c ++++ b/net/bridge/netfilter/nf_tables_bridge.c +@@ -95,11 +95,6 @@ static const struct nf_chain_type filter + (1 << NF_BR_POST_ROUTING), + }; + +-static void nf_br_saveroute(const struct sk_buff *skb, +- struct nf_queue_entry *entry) +-{ +-} +- + static int nf_br_reroute(struct net *net, struct sk_buff *skb, + const struct nf_queue_entry *entry) + { +@@ -115,7 +110,6 @@ static int nf_br_route(struct net *net, + static const struct nf_afinfo nf_br_afinfo = { + .family = AF_BRIDGE, + .route = nf_br_route, +- .saveroute = nf_br_saveroute, + .reroute = nf_br_reroute, + .route_key_size = 0, + }; +--- a/net/ipv4/netfilter.c ++++ b/net/ipv4/netfilter.c +@@ -80,33 +80,6 @@ int ip_route_me_harder(struct net *net, + } + EXPORT_SYMBOL(ip_route_me_harder); + +-/* +- * Extra routing may needed on local out, as the QUEUE target never +- * returns control to the table. +- */ +- +-struct ip_rt_info { +- __be32 daddr; +- __be32 saddr; +- u_int8_t tos; +- u_int32_t mark; +-}; +- +-static void nf_ip_saveroute(const struct sk_buff *skb, +- struct nf_queue_entry *entry) +-{ +- struct ip_rt_info *rt_info = nf_queue_entry_reroute(entry); +- +- if (entry->state.hook == NF_INET_LOCAL_OUT) { +- const struct iphdr *iph = ip_hdr(skb); +- +- rt_info->tos = iph->tos; +- rt_info->daddr = iph->daddr; +- rt_info->saddr = iph->saddr; +- rt_info->mark = skb->mark; +- } +-} +- + static int nf_ip_reroute(struct net *net, struct sk_buff *skb, + const struct nf_queue_entry *entry) + { +@@ -190,7 +163,6 @@ static int nf_ip_route(struct net *net, + static const struct nf_afinfo nf_ip_afinfo = { + .family = AF_INET, + .route = nf_ip_route, +- .saveroute = nf_ip_saveroute, + .reroute = nf_ip_reroute, + .route_key_size = sizeof(struct ip_rt_info), + }; +--- a/net/ipv6/netfilter.c ++++ b/net/ipv6/netfilter.c +@@ -69,31 +69,6 @@ int ip6_route_me_harder(struct net *net, + } + EXPORT_SYMBOL(ip6_route_me_harder); + +-/* +- * Extra routing may needed on local out, as the QUEUE target never +- * returns control to the table. +- */ +- +-struct ip6_rt_info { +- struct in6_addr daddr; +- struct in6_addr saddr; +- u_int32_t mark; +-}; +- +-static void nf_ip6_saveroute(const struct sk_buff *skb, +- struct nf_queue_entry *entry) +-{ +- struct ip6_rt_info *rt_info = nf_queue_entry_reroute(entry); +- +- if (entry->state.hook == NF_INET_LOCAL_OUT) { +- const struct ipv6hdr *iph = ipv6_hdr(skb); +- +- rt_info->daddr = iph->daddr; +- rt_info->saddr = iph->saddr; +- rt_info->mark = skb->mark; +- } +-} +- + static int nf_ip6_reroute(struct net *net, struct sk_buff *skb, + const struct nf_queue_entry *entry) + { +@@ -201,7 +176,6 @@ static const struct nf_ipv6_ops ipv6ops + static const struct nf_afinfo nf_ip6_afinfo = { + .family = AF_INET6, + .route = nf_ip6_route, +- .saveroute = nf_ip6_saveroute, + .reroute = nf_ip6_reroute, + .route_key_size = sizeof(struct ip6_rt_info), + }; +--- a/net/netfilter/nf_queue.c ++++ b/net/netfilter/nf_queue.c +@@ -10,6 +10,8 @@ + #include <linux/proc_fs.h> + #include <linux/skbuff.h> + #include <linux/netfilter.h> ++#include <linux/netfilter_ipv4.h> ++#include <linux/netfilter_ipv6.h> + #include <linux/netfilter_bridge.h> + #include <linux/seq_file.h> + #include <linux/rcupdate.h> +@@ -108,6 +110,35 @@ void nf_queue_nf_hook_drop(struct net *n + } + EXPORT_SYMBOL_GPL(nf_queue_nf_hook_drop); + ++static void nf_ip_saveroute(const struct sk_buff *skb, ++ struct nf_queue_entry *entry) ++{ ++ struct ip_rt_info *rt_info = nf_queue_entry_reroute(entry); ++ ++ if (entry->state.hook == NF_INET_LOCAL_OUT) { ++ const struct iphdr *iph = ip_hdr(skb); ++ ++ rt_info->tos = iph->tos; ++ rt_info->daddr = iph->daddr; ++ rt_info->saddr = iph->saddr; ++ rt_info->mark = skb->mark; ++ } ++} ++ ++static void nf_ip6_saveroute(const struct sk_buff *skb, ++ struct nf_queue_entry *entry) ++{ ++ struct ip6_rt_info *rt_info = nf_queue_entry_reroute(entry); ++ ++ if (entry->state.hook == NF_INET_LOCAL_OUT) { ++ const struct ipv6hdr *iph = ipv6_hdr(skb); ++ ++ rt_info->daddr = iph->daddr; ++ rt_info->saddr = iph->saddr; ++ rt_info->mark = skb->mark; ++ } ++} ++ + static int __nf_queue(struct sk_buff *skb, const struct nf_hook_state *state, + const struct nf_hook_entries *entries, + unsigned int index, unsigned int queuenum) +@@ -144,7 +175,16 @@ static int __nf_queue(struct sk_buff *sk + + nf_queue_entry_get_refs(entry); + skb_dst_force(skb); +- afinfo->saveroute(skb, entry); ++ ++ switch (entry->state.pf) { ++ case AF_INET: ++ nf_ip_saveroute(skb, entry); ++ break; ++ case AF_INET6: ++ nf_ip6_saveroute(skb, entry); ++ break; ++ } ++ + status = qh->outfn(entry, queuenum); + + if (status < 0) { diff --git a/target/linux/generic/backport-4.19/307-v4.16-netfilter-move-route-indirection-to-struct-nf_ipv6_o.patch b/target/linux/generic/backport-4.19/307-v4.16-netfilter-move-route-indirection-to-struct-nf_ipv6_o.patch new file mode 100644 index 0000000000..b98aac0fff --- /dev/null +++ b/target/linux/generic/backport-4.19/307-v4.16-netfilter-move-route-indirection-to-struct-nf_ipv6_o.patch @@ -0,0 +1,349 @@ +From: Pablo Neira Ayuso <pablo@netfilter.org> +Date: Mon, 27 Nov 2017 22:29:52 +0100 +Subject: [PATCH] netfilter: move route indirection to struct nf_ipv6_ops + +We cannot make a direct call to nf_ip6_route() because that would result +in autoloading the 'ipv6' module because of symbol dependencies. +Therefore, define route indirection in nf_ipv6_ops where this really +belongs to. + +For IPv4, we can indeed make a direct function call, which is faster, +given IPv4 is built-in in the networking code by default. Still, +CONFIG_INET=n and CONFIG_NETFILTER=y is possible, so define empty inline +stub for IPv4 in such case. + +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + +--- a/include/linux/netfilter.h ++++ b/include/linux/netfilter.h +@@ -311,8 +311,6 @@ struct nf_queue_entry; + + struct nf_afinfo { + unsigned short family; +- int (*route)(struct net *net, struct dst_entry **dst, +- struct flowi *fl, bool strict); + int (*reroute)(struct net *net, struct sk_buff *skb, + const struct nf_queue_entry *entry); + int route_key_size; +@@ -331,6 +329,8 @@ __sum16 nf_checksum(struct sk_buff *skb, + __sum16 nf_checksum_partial(struct sk_buff *skb, unsigned int hook, + unsigned int dataoff, unsigned int len, + u_int8_t protocol, unsigned short family); ++int nf_route(struct net *net, struct dst_entry **dst, struct flowi *fl, ++ bool strict, unsigned short family); + + int nf_register_afinfo(const struct nf_afinfo *afinfo); + void nf_unregister_afinfo(const struct nf_afinfo *afinfo); +--- a/include/linux/netfilter_ipv4.h ++++ b/include/linux/netfilter_ipv4.h +@@ -24,6 +24,8 @@ __sum16 nf_ip_checksum(struct sk_buff *s + __sum16 nf_ip_checksum_partial(struct sk_buff *skb, unsigned int hook, + unsigned int dataoff, unsigned int len, + u_int8_t protocol); ++int nf_ip_route(struct net *net, struct dst_entry **dst, struct flowi *fl, ++ bool strict); + #else + static inline __sum16 nf_ip_checksum(struct sk_buff *skb, unsigned int hook, + unsigned int dataoff, u_int8_t protocol) +@@ -38,6 +40,11 @@ static inline __sum16 nf_ip_checksum_par + { + return 0; + } ++static inline int nf_ip_route(struct net *net, struct dst_entry **dst, ++ struct flowi *fl, bool strict) ++{ ++ return -EOPNOTSUPP; ++} + #endif /* CONFIG_INET */ + + #endif /*__LINUX_IP_NETFILTER_H*/ +--- a/include/linux/netfilter_ipv6.h ++++ b/include/linux/netfilter_ipv6.h +@@ -33,6 +33,8 @@ struct nf_ipv6_ops { + __sum16 (*checksum_partial)(struct sk_buff *skb, unsigned int hook, + unsigned int dataoff, unsigned int len, + u_int8_t protocol); ++ int (*route)(struct net *net, struct dst_entry **dst, struct flowi *fl, ++ bool strict); + }; + + #ifdef CONFIG_NETFILTER +--- a/net/bridge/netfilter/nf_tables_bridge.c ++++ b/net/bridge/netfilter/nf_tables_bridge.c +@@ -101,15 +101,8 @@ static int nf_br_reroute(struct net *net + return 0; + } + +-static int nf_br_route(struct net *net, struct dst_entry **dst, +- struct flowi *fl, bool strict __always_unused) +-{ +- return 0; +-} +- + static const struct nf_afinfo nf_br_afinfo = { + .family = AF_BRIDGE, +- .route = nf_br_route, + .reroute = nf_br_reroute, + .route_key_size = 0, + }; +--- a/net/ipv4/netfilter.c ++++ b/net/ipv4/netfilter.c +@@ -150,8 +150,8 @@ __sum16 nf_ip_checksum_partial(struct sk + } + EXPORT_SYMBOL_GPL(nf_ip_checksum_partial); + +-static int nf_ip_route(struct net *net, struct dst_entry **dst, +- struct flowi *fl, bool strict __always_unused) ++int nf_ip_route(struct net *net, struct dst_entry **dst, struct flowi *fl, ++ bool strict __always_unused) + { + struct rtable *rt = ip_route_output_key(net, &fl->u.ip4); + if (IS_ERR(rt)) +@@ -159,10 +159,10 @@ static int nf_ip_route(struct net *net, + *dst = &rt->dst; + return 0; + } ++EXPORT_SYMBOL_GPL(nf_ip_route); + + static const struct nf_afinfo nf_ip_afinfo = { + .family = AF_INET, +- .route = nf_ip_route, + .reroute = nf_ip_reroute, + .route_key_size = sizeof(struct ip_rt_info), + }; +--- a/net/ipv6/netfilter.c ++++ b/net/ipv6/netfilter.c +@@ -171,11 +171,11 @@ static const struct nf_ipv6_ops ipv6ops + .fragment = ip6_fragment, + .checksum = nf_ip6_checksum, + .checksum_partial = nf_ip6_checksum_partial, ++ .route = nf_ip6_route, + }; + + static const struct nf_afinfo nf_ip6_afinfo = { + .family = AF_INET6, +- .route = nf_ip6_route, + .reroute = nf_ip6_reroute, + .route_key_size = sizeof(struct ip6_rt_info), + }; +--- a/net/ipv6/netfilter/nft_fib_ipv6.c ++++ b/net/ipv6/netfilter/nft_fib_ipv6.c +@@ -60,7 +60,6 @@ static u32 __nft_fib6_eval_type(const st + { + const struct net_device *dev = NULL; + const struct nf_ipv6_ops *v6ops; +- const struct nf_afinfo *afinfo; + int route_err, addrtype; + struct rt6_info *rt; + struct flowi6 fl6 = { +@@ -69,8 +68,8 @@ static u32 __nft_fib6_eval_type(const st + }; + u32 ret = 0; + +- afinfo = nf_get_afinfo(NFPROTO_IPV6); +- if (!afinfo) ++ v6ops = nf_get_ipv6_ops(); ++ if (!v6ops) + return RTN_UNREACHABLE; + + if (priv->flags & NFTA_FIB_F_IIF) +@@ -80,12 +79,11 @@ static u32 __nft_fib6_eval_type(const st + + nft_fib6_flowi_init(&fl6, priv, pkt, dev, iph); + +- v6ops = nf_get_ipv6_ops(); +- if (dev && v6ops && v6ops->chk_addr(nft_net(pkt), &fl6.daddr, dev, true)) ++ if (dev && v6ops->chk_addr(nft_net(pkt), &fl6.daddr, dev, true)) + ret = RTN_LOCAL; + +- route_err = afinfo->route(nft_net(pkt), (struct dst_entry **)&rt, +- flowi6_to_flowi(&fl6), false); ++ route_err = v6ops->route(nft_net(pkt), (struct dst_entry **)&rt, ++ flowi6_to_flowi(&fl6), false); + if (route_err) + goto err; + +--- a/net/netfilter/nf_conntrack_h323_main.c ++++ b/net/netfilter/nf_conntrack_h323_main.c +@@ -24,6 +24,7 @@ + #include <linux/skbuff.h> + #include <net/route.h> + #include <net/ip6_route.h> ++#include <linux/netfilter_ipv6.h> + + #include <net/netfilter/nf_conntrack.h> + #include <net/netfilter/nf_conntrack_core.h> +@@ -732,14 +733,8 @@ static int callforward_do_filter(struct + const union nf_inet_addr *dst, + u_int8_t family) + { +- const struct nf_afinfo *afinfo; + int ret = 0; + +- /* rcu_read_lock()ed by nf_hook_thresh */ +- afinfo = nf_get_afinfo(family); +- if (!afinfo) +- return 0; +- + switch (family) { + case AF_INET: { + struct flowi4 fl1, fl2; +@@ -750,10 +745,10 @@ static int callforward_do_filter(struct + + memset(&fl2, 0, sizeof(fl2)); + fl2.daddr = dst->ip; +- if (!afinfo->route(net, (struct dst_entry **)&rt1, +- flowi4_to_flowi(&fl1), false)) { +- if (!afinfo->route(net, (struct dst_entry **)&rt2, +- flowi4_to_flowi(&fl2), false)) { ++ if (!nf_ip_route(net, (struct dst_entry **)&rt1, ++ flowi4_to_flowi(&fl1), false)) { ++ if (!nf_ip_route(net, (struct dst_entry **)&rt2, ++ flowi4_to_flowi(&fl2), false)) { + if (rt_nexthop(rt1, fl1.daddr) == + rt_nexthop(rt2, fl2.daddr) && + rt1->dst.dev == rt2->dst.dev) +@@ -766,18 +761,23 @@ static int callforward_do_filter(struct + } + #if IS_ENABLED(CONFIG_NF_CONNTRACK_IPV6) + case AF_INET6: { +- struct flowi6 fl1, fl2; ++ const struct nf_ipv6_ops *v6ops; + struct rt6_info *rt1, *rt2; ++ struct flowi6 fl1, fl2; ++ ++ v6ops = nf_get_ipv6_ops(); ++ if (!v6ops) ++ return 0; + + memset(&fl1, 0, sizeof(fl1)); + fl1.daddr = src->in6; + + memset(&fl2, 0, sizeof(fl2)); + fl2.daddr = dst->in6; +- if (!afinfo->route(net, (struct dst_entry **)&rt1, +- flowi6_to_flowi(&fl1), false)) { +- if (!afinfo->route(net, (struct dst_entry **)&rt2, +- flowi6_to_flowi(&fl2), false)) { ++ if (!v6ops->route(net, (struct dst_entry **)&rt1, ++ flowi6_to_flowi(&fl1), false)) { ++ if (!v6ops->route(net, (struct dst_entry **)&rt2, ++ flowi6_to_flowi(&fl2), false)) { + if (ipv6_addr_equal(rt6_nexthop(rt1, &fl1.daddr), + rt6_nexthop(rt2, &fl2.daddr)) && + rt1->dst.dev == rt2->dst.dev) +--- a/net/netfilter/nft_rt.c ++++ b/net/netfilter/nft_rt.c +@@ -27,7 +27,7 @@ static u16 get_tcpmss(const struct nft_p + { + u32 minlen = sizeof(struct ipv6hdr), mtu = dst_mtu(skbdst); + const struct sk_buff *skb = pkt->skb; +- const struct nf_afinfo *ai; ++ struct dst_entry *dst = NULL; + struct flowi fl; + + memset(&fl, 0, sizeof(fl)); +@@ -43,15 +43,10 @@ static u16 get_tcpmss(const struct nft_p + break; + } + +- ai = nf_get_afinfo(nft_pf(pkt)); +- if (ai) { +- struct dst_entry *dst = NULL; +- +- ai->route(nft_net(pkt), &dst, &fl, false); +- if (dst) { +- mtu = min(mtu, dst_mtu(dst)); +- dst_release(dst); +- } ++ nf_route(nft_net(pkt), &dst, &fl, false, nft_pf(pkt)); ++ if (dst) { ++ mtu = min(mtu, dst_mtu(dst)); ++ dst_release(dst); + } + + if (mtu <= minlen || mtu > 0xffff) +--- a/net/netfilter/utils.c ++++ b/net/netfilter/utils.c +@@ -48,3 +48,24 @@ __sum16 nf_checksum_partial(struct sk_bu + return csum; + } + EXPORT_SYMBOL_GPL(nf_checksum_partial); ++ ++int nf_route(struct net *net, struct dst_entry **dst, struct flowi *fl, ++ bool strict, unsigned short family) ++{ ++ const struct nf_ipv6_ops *v6ops; ++ int ret = 0; ++ ++ switch (family) { ++ case AF_INET: ++ ret = nf_ip_route(net, dst, fl, strict); ++ break; ++ case AF_INET6: ++ v6ops = rcu_dereference(nf_ipv6_ops); ++ if (v6ops) ++ ret = v6ops->route(net, dst, fl, strict); ++ break; ++ } ++ ++ return ret; ++} ++EXPORT_SYMBOL_GPL(nf_route); +--- a/net/netfilter/xt_TCPMSS.c ++++ b/net/netfilter/xt_TCPMSS.c +@@ -48,7 +48,6 @@ static u_int32_t tcpmss_reverse_mtu(stru + unsigned int family) + { + struct flowi fl; +- const struct nf_afinfo *ai; + struct rtable *rt = NULL; + u_int32_t mtu = ~0U; + +@@ -62,10 +61,8 @@ static u_int32_t tcpmss_reverse_mtu(stru + memset(fl6, 0, sizeof(*fl6)); + fl6->daddr = ipv6_hdr(skb)->saddr; + } +- ai = nf_get_afinfo(family); +- if (ai != NULL) +- ai->route(net, (struct dst_entry **)&rt, &fl, false); + ++ nf_route(net, (struct dst_entry **)&rt, &fl, false, family); + if (rt != NULL) { + mtu = dst_mtu(&rt->dst); + dst_release(&rt->dst); +--- a/net/netfilter/xt_addrtype.c ++++ b/net/netfilter/xt_addrtype.c +@@ -36,7 +36,7 @@ MODULE_ALIAS("ip6t_addrtype"); + static u32 match_lookup_rt6(struct net *net, const struct net_device *dev, + const struct in6_addr *addr, u16 mask) + { +- const struct nf_afinfo *afinfo; ++ const struct nf_ipv6_ops *v6ops; + struct flowi6 flow; + struct rt6_info *rt; + u32 ret = 0; +@@ -47,17 +47,14 @@ static u32 match_lookup_rt6(struct net * + if (dev) + flow.flowi6_oif = dev->ifindex; + +- afinfo = nf_get_afinfo(NFPROTO_IPV6); +- if (afinfo != NULL) { +- const struct nf_ipv6_ops *v6ops; +- ++ v6ops = nf_get_ipv6_ops(); ++ if (v6ops) { + if (dev && (mask & XT_ADDRTYPE_LOCAL)) { +- v6ops = nf_get_ipv6_ops(); +- if (v6ops && v6ops->chk_addr(net, addr, dev, true)) ++ if (v6ops->chk_addr(net, addr, dev, true)) + ret = XT_ADDRTYPE_LOCAL; + } +- route_err = afinfo->route(net, (struct dst_entry **)&rt, +- flowi6_to_flowi(&flow), false); ++ route_err = v6ops->route(net, (struct dst_entry **)&rt, ++ flowi6_to_flowi(&flow), false); + } else { + route_err = 1; + } diff --git a/target/linux/generic/backport-4.19/308-v4.16-netfilter-move-reroute-indirection-to-struct-nf_ipv6.patch b/target/linux/generic/backport-4.19/308-v4.16-netfilter-move-reroute-indirection-to-struct-nf_ipv6.patch new file mode 100644 index 0000000000..5dbd1a4cea --- /dev/null +++ b/target/linux/generic/backport-4.19/308-v4.16-netfilter-move-reroute-indirection-to-struct-nf_ipv6.patch @@ -0,0 +1,223 @@ +From: Pablo Neira Ayuso <pablo@netfilter.org> +Date: Mon, 27 Nov 2017 22:50:26 +0100 +Subject: [PATCH] netfilter: move reroute indirection to struct nf_ipv6_ops + +We cannot make a direct call to nf_ip6_reroute() because that would result +in autoloading the 'ipv6' module because of symbol dependencies. +Therefore, define reroute indirection in nf_ipv6_ops where this really +belongs to. + +For IPv4, we can indeed make a direct function call, which is faster, +given IPv4 is built-in in the networking code by default. Still, +CONFIG_INET=n and CONFIG_NETFILTER=y is possible, so define empty inline +stub for IPv4 in such case. + +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + +--- a/include/linux/netfilter.h ++++ b/include/linux/netfilter.h +@@ -311,8 +311,6 @@ struct nf_queue_entry; + + struct nf_afinfo { + unsigned short family; +- int (*reroute)(struct net *net, struct sk_buff *skb, +- const struct nf_queue_entry *entry); + int route_key_size; + }; + +@@ -331,6 +329,7 @@ __sum16 nf_checksum_partial(struct sk_bu + u_int8_t protocol, unsigned short family); + int nf_route(struct net *net, struct dst_entry **dst, struct flowi *fl, + bool strict, unsigned short family); ++int nf_reroute(struct sk_buff *skb, struct nf_queue_entry *entry); + + int nf_register_afinfo(const struct nf_afinfo *afinfo); + void nf_unregister_afinfo(const struct nf_afinfo *afinfo); +--- a/include/linux/netfilter_ipv4.h ++++ b/include/linux/netfilter_ipv4.h +@@ -18,6 +18,8 @@ struct ip_rt_info { + + int ip_route_me_harder(struct net *net, struct sk_buff *skb, unsigned addr_type); + ++struct nf_queue_entry; ++ + #ifdef CONFIG_INET + __sum16 nf_ip_checksum(struct sk_buff *skb, unsigned int hook, + unsigned int dataoff, u_int8_t protocol); +@@ -26,6 +28,7 @@ __sum16 nf_ip_checksum_partial(struct sk + u_int8_t protocol); + int nf_ip_route(struct net *net, struct dst_entry **dst, struct flowi *fl, + bool strict); ++int nf_ip_reroute(struct sk_buff *skb, const struct nf_queue_entry *entry); + #else + static inline __sum16 nf_ip_checksum(struct sk_buff *skb, unsigned int hook, + unsigned int dataoff, u_int8_t protocol) +@@ -45,6 +48,11 @@ static inline int nf_ip_route(struct net + { + return -EOPNOTSUPP; + } ++static inline int nf_ip_reroute(struct sk_buff *skb, ++ const struct nf_queue_entry *entry) ++{ ++ return -EOPNOTSUPP; ++} + #endif /* CONFIG_INET */ + + #endif /*__LINUX_IP_NETFILTER_H*/ +--- a/include/linux/netfilter_ipv6.h ++++ b/include/linux/netfilter_ipv6.h +@@ -18,6 +18,8 @@ struct ip6_rt_info { + u_int32_t mark; + }; + ++struct nf_queue_entry; ++ + /* + * Hook functions for ipv6 to allow xt_* modules to be built-in even + * if IPv6 is a module. +@@ -35,6 +37,7 @@ struct nf_ipv6_ops { + u_int8_t protocol); + int (*route)(struct net *net, struct dst_entry **dst, struct flowi *fl, + bool strict); ++ int (*reroute)(struct sk_buff *skb, const struct nf_queue_entry *entry); + }; + + #ifdef CONFIG_NETFILTER +--- a/net/bridge/netfilter/nf_tables_bridge.c ++++ b/net/bridge/netfilter/nf_tables_bridge.c +@@ -95,15 +95,8 @@ static const struct nf_chain_type filter + (1 << NF_BR_POST_ROUTING), + }; + +-static int nf_br_reroute(struct net *net, struct sk_buff *skb, +- const struct nf_queue_entry *entry) +-{ +- return 0; +-} +- + static const struct nf_afinfo nf_br_afinfo = { + .family = AF_BRIDGE, +- .reroute = nf_br_reroute, + .route_key_size = 0, + }; + +--- a/net/ipv4/netfilter.c ++++ b/net/ipv4/netfilter.c +@@ -80,8 +80,7 @@ int ip_route_me_harder(struct net *net, + } + EXPORT_SYMBOL(ip_route_me_harder); + +-static int nf_ip_reroute(struct net *net, struct sk_buff *skb, +- const struct nf_queue_entry *entry) ++int nf_ip_reroute(struct sk_buff *skb, const struct nf_queue_entry *entry) + { + const struct ip_rt_info *rt_info = nf_queue_entry_reroute(entry); + +@@ -92,10 +91,12 @@ static int nf_ip_reroute(struct net *net + skb->mark == rt_info->mark && + iph->daddr == rt_info->daddr && + iph->saddr == rt_info->saddr)) +- return ip_route_me_harder(net, skb, RTN_UNSPEC); ++ return ip_route_me_harder(entry->state.net, skb, ++ RTN_UNSPEC); + } + return 0; + } ++EXPORT_SYMBOL_GPL(nf_ip_reroute); + + __sum16 nf_ip_checksum(struct sk_buff *skb, unsigned int hook, + unsigned int dataoff, u_int8_t protocol) +@@ -163,7 +164,6 @@ EXPORT_SYMBOL_GPL(nf_ip_route); + + static const struct nf_afinfo nf_ip_afinfo = { + .family = AF_INET, +- .reroute = nf_ip_reroute, + .route_key_size = sizeof(struct ip_rt_info), + }; + +--- a/net/ipv6/netfilter.c ++++ b/net/ipv6/netfilter.c +@@ -69,7 +69,7 @@ int ip6_route_me_harder(struct net *net, + } + EXPORT_SYMBOL(ip6_route_me_harder); + +-static int nf_ip6_reroute(struct net *net, struct sk_buff *skb, ++static int nf_ip6_reroute(struct sk_buff *skb, + const struct nf_queue_entry *entry) + { + struct ip6_rt_info *rt_info = nf_queue_entry_reroute(entry); +@@ -79,7 +79,7 @@ static int nf_ip6_reroute(struct net *ne + if (!ipv6_addr_equal(&iph->daddr, &rt_info->daddr) || + !ipv6_addr_equal(&iph->saddr, &rt_info->saddr) || + skb->mark != rt_info->mark) +- return ip6_route_me_harder(net, skb); ++ return ip6_route_me_harder(entry->state.net, skb); + } + return 0; + } +@@ -172,11 +172,11 @@ static const struct nf_ipv6_ops ipv6ops + .checksum = nf_ip6_checksum, + .checksum_partial = nf_ip6_checksum_partial, + .route = nf_ip6_route, ++ .reroute = nf_ip6_reroute, + }; + + static const struct nf_afinfo nf_ip6_afinfo = { + .family = AF_INET6, +- .reroute = nf_ip6_reroute, + .route_key_size = sizeof(struct ip6_rt_info), + }; + +--- a/net/netfilter/nf_queue.c ++++ b/net/netfilter/nf_queue.c +@@ -266,7 +266,6 @@ void nf_reinject(struct nf_queue_entry * + const struct nf_hook_entry *hook_entry; + const struct nf_hook_entries *hooks; + struct sk_buff *skb = entry->skb; +- const struct nf_afinfo *afinfo; + const struct net *net; + unsigned int i; + int err; +@@ -293,8 +292,7 @@ void nf_reinject(struct nf_queue_entry * + verdict = nf_hook_entry_hookfn(hook_entry, skb, &entry->state); + + if (verdict == NF_ACCEPT) { +- afinfo = nf_get_afinfo(entry->state.pf); +- if (!afinfo || afinfo->reroute(entry->state.net, skb, entry) < 0) ++ if (nf_reroute(skb, entry) < 0) + verdict = NF_DROP; + } + +--- a/net/netfilter/utils.c ++++ b/net/netfilter/utils.c +@@ -2,6 +2,7 @@ + #include <linux/netfilter.h> + #include <linux/netfilter_ipv4.h> + #include <linux/netfilter_ipv6.h> ++#include <net/netfilter/nf_queue.h> + + __sum16 nf_checksum(struct sk_buff *skb, unsigned int hook, + unsigned int dataoff, u_int8_t protocol, +@@ -69,3 +70,21 @@ int nf_route(struct net *net, struct dst + return ret; + } + EXPORT_SYMBOL_GPL(nf_route); ++ ++int nf_reroute(struct sk_buff *skb, struct nf_queue_entry *entry) ++{ ++ const struct nf_ipv6_ops *v6ops; ++ int ret = 0; ++ ++ switch (entry->state.pf) { ++ case AF_INET: ++ ret = nf_ip_reroute(skb, entry); ++ break; ++ case AF_INET6: ++ v6ops = rcu_dereference(nf_ipv6_ops); ++ if (v6ops) ++ ret = v6ops->reroute(skb, entry); ++ break; ++ } ++ return ret; ++} diff --git a/target/linux/generic/backport-4.19/309-v4.16-netfilter-remove-route_key_size-field-in-struct-nf_a.patch b/target/linux/generic/backport-4.19/309-v4.16-netfilter-remove-route_key_size-field-in-struct-nf_a.patch new file mode 100644 index 0000000000..21381b7e6b --- /dev/null +++ b/target/linux/generic/backport-4.19/309-v4.16-netfilter-remove-route_key_size-field-in-struct-nf_a.patch @@ -0,0 +1,94 @@ +From: Pablo Neira Ayuso <pablo@netfilter.org> +Date: Mon, 27 Nov 2017 22:58:37 +0100 +Subject: [PATCH] netfilter: remove route_key_size field in struct nf_afinfo + +This is only needed by nf_queue, place this code where it belongs. + +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + +--- a/include/linux/netfilter.h ++++ b/include/linux/netfilter.h +@@ -311,7 +311,6 @@ struct nf_queue_entry; + + struct nf_afinfo { + unsigned short family; +- int route_key_size; + }; + + extern const struct nf_afinfo __rcu *nf_afinfo[NFPROTO_NUMPROTO]; +--- a/net/ipv4/netfilter.c ++++ b/net/ipv4/netfilter.c +@@ -164,7 +164,6 @@ EXPORT_SYMBOL_GPL(nf_ip_route); + + static const struct nf_afinfo nf_ip_afinfo = { + .family = AF_INET, +- .route_key_size = sizeof(struct ip_rt_info), + }; + + static int __init ipv4_netfilter_init(void) +--- a/net/ipv6/netfilter.c ++++ b/net/ipv6/netfilter.c +@@ -177,7 +177,6 @@ static const struct nf_ipv6_ops ipv6ops + + static const struct nf_afinfo nf_ip6_afinfo = { + .family = AF_INET6, +- .route_key_size = sizeof(struct ip6_rt_info), + }; + + int __init ipv6_netfilter_init(void) +--- a/net/netfilter/nf_queue.c ++++ b/net/netfilter/nf_queue.c +@@ -15,6 +15,8 @@ + #include <linux/netfilter_bridge.h> + #include <linux/seq_file.h> + #include <linux/rcupdate.h> ++#include <linux/netfilter_ipv4.h> ++#include <linux/netfilter_ipv6.h> + #include <net/protocol.h> + #include <net/netfilter/nf_queue.h> + #include <net/dst.h> +@@ -145,9 +147,9 @@ static int __nf_queue(struct sk_buff *sk + { + int status = -ENOENT; + struct nf_queue_entry *entry = NULL; +- const struct nf_afinfo *afinfo; + const struct nf_queue_handler *qh; + struct net *net = state->net; ++ unsigned int route_key_size; + + /* QUEUE == DROP if no one is waiting, to be safe. */ + qh = rcu_dereference(net->nf.queue_handler); +@@ -156,11 +158,19 @@ static int __nf_queue(struct sk_buff *sk + goto err; + } + +- afinfo = nf_get_afinfo(state->pf); +- if (!afinfo) +- goto err; ++ switch (state->pf) { ++ case AF_INET: ++ route_key_size = sizeof(struct ip_rt_info); ++ break; ++ case AF_INET6: ++ route_key_size = sizeof(struct ip6_rt_info); ++ break; ++ default: ++ route_key_size = 0; ++ break; ++ } + +- entry = kmalloc(sizeof(*entry) + afinfo->route_key_size, GFP_ATOMIC); ++ entry = kmalloc(sizeof(*entry) + route_key_size, GFP_ATOMIC); + if (!entry) { + status = -ENOMEM; + goto err; +@@ -170,7 +180,7 @@ static int __nf_queue(struct sk_buff *sk + .skb = skb, + .state = *state, + .hook_index = index, +- .size = sizeof(*entry) + afinfo->route_key_size, ++ .size = sizeof(*entry) + route_key_size, + }; + + nf_queue_entry_get_refs(entry); diff --git a/target/linux/generic/backport-4.19/310-v4.16-netfilter-remove-struct-nf_afinfo-and-its-helper-fun.patch b/target/linux/generic/backport-4.19/310-v4.16-netfilter-remove-struct-nf_afinfo-and-its-helper-fun.patch new file mode 100644 index 0000000000..0ca58f9988 --- /dev/null +++ b/target/linux/generic/backport-4.19/310-v4.16-netfilter-remove-struct-nf_afinfo-and-its-helper-fun.patch @@ -0,0 +1,173 @@ +From: Pablo Neira Ayuso <pablo@netfilter.org> +Date: Sat, 9 Dec 2017 17:05:53 +0100 +Subject: [PATCH] netfilter: remove struct nf_afinfo and its helper functions + +This abstraction has no clients anymore, remove it. + +This is what remains from previous authors, so correct copyright +statement after recent modifications and code removal. + +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + +--- a/include/linux/netfilter.h ++++ b/include/linux/netfilter.h +@@ -309,16 +309,6 @@ int skb_make_writable(struct sk_buff *sk + struct flowi; + struct nf_queue_entry; + +-struct nf_afinfo { +- unsigned short family; +-}; +- +-extern const struct nf_afinfo __rcu *nf_afinfo[NFPROTO_NUMPROTO]; +-static inline const struct nf_afinfo *nf_get_afinfo(unsigned short family) +-{ +- return rcu_dereference(nf_afinfo[family]); +-} +- + __sum16 nf_checksum(struct sk_buff *skb, unsigned int hook, + unsigned int dataoff, u_int8_t protocol, + unsigned short family); +@@ -330,9 +320,6 @@ int nf_route(struct net *net, struct dst + bool strict, unsigned short family); + int nf_reroute(struct sk_buff *skb, struct nf_queue_entry *entry); + +-int nf_register_afinfo(const struct nf_afinfo *afinfo); +-void nf_unregister_afinfo(const struct nf_afinfo *afinfo); +- + #include <net/flow.h> + extern void (*nf_nat_decode_session_hook)(struct sk_buff *, struct flowi *); + +--- a/net/bridge/netfilter/nf_tables_bridge.c ++++ b/net/bridge/netfilter/nf_tables_bridge.c +@@ -95,30 +95,23 @@ static const struct nf_chain_type filter + (1 << NF_BR_POST_ROUTING), + }; + +-static const struct nf_afinfo nf_br_afinfo = { +- .family = AF_BRIDGE, +- .route_key_size = 0, +-}; +- + static int __init nf_tables_bridge_init(void) + { + int ret; + +- nf_register_afinfo(&nf_br_afinfo); + ret = nft_register_chain_type(&filter_bridge); + if (ret < 0) +- goto err1; ++ return ret; + + ret = register_pernet_subsys(&nf_tables_bridge_net_ops); + if (ret < 0) +- goto err2; ++ goto err_register_subsys; + + return ret; + +-err2: ++err_register_subsys: + nft_unregister_chain_type(&filter_bridge); +-err1: +- nf_unregister_afinfo(&nf_br_afinfo); ++ + return ret; + } + +@@ -126,7 +119,6 @@ static void __exit nf_tables_bridge_exit + { + unregister_pernet_subsys(&nf_tables_bridge_net_ops); + nft_unregister_chain_type(&filter_bridge); +- nf_unregister_afinfo(&nf_br_afinfo); + } + + module_init(nf_tables_bridge_init); +--- a/net/ipv4/netfilter.c ++++ b/net/ipv4/netfilter.c +@@ -161,13 +161,3 @@ int nf_ip_route(struct net *net, struct + return 0; + } + EXPORT_SYMBOL_GPL(nf_ip_route); +- +-static const struct nf_afinfo nf_ip_afinfo = { +- .family = AF_INET, +-}; +- +-static int __init ipv4_netfilter_init(void) +-{ +- return nf_register_afinfo(&nf_ip_afinfo); +-} +-subsys_initcall(ipv4_netfilter_init); +--- a/net/ipv6/netfilter.c ++++ b/net/ipv6/netfilter.c +@@ -175,14 +175,10 @@ static const struct nf_ipv6_ops ipv6ops + .reroute = nf_ip6_reroute, + }; + +-static const struct nf_afinfo nf_ip6_afinfo = { +- .family = AF_INET6, +-}; +- + int __init ipv6_netfilter_init(void) + { + RCU_INIT_POINTER(nf_ipv6_ops, &ipv6ops); +- return nf_register_afinfo(&nf_ip6_afinfo); ++ return 0; + } + + /* This can be called from inet6_init() on errors, so it cannot +@@ -191,5 +187,4 @@ int __init ipv6_netfilter_init(void) + void ipv6_netfilter_fini(void) + { + RCU_INIT_POINTER(nf_ipv6_ops, NULL); +- nf_unregister_afinfo(&nf_ip6_afinfo); + } +--- a/net/netfilter/core.c ++++ b/net/netfilter/core.c +@@ -4,8 +4,7 @@ + * Thanks to Rob `CmdrTaco' Malda for not influencing this code in any + * way. + * +- * Rusty Russell (C)2000 -- This code is GPL. +- * Patrick McHardy (c) 2006-2012 ++ * This code is GPL. + */ + #include <linux/kernel.h> + #include <linux/netfilter.h> +@@ -28,34 +27,12 @@ + + #include "nf_internals.h" + +-static DEFINE_MUTEX(afinfo_mutex); +- +-const struct nf_afinfo __rcu *nf_afinfo[NFPROTO_NUMPROTO] __read_mostly; +-EXPORT_SYMBOL(nf_afinfo); + const struct nf_ipv6_ops __rcu *nf_ipv6_ops __read_mostly; + EXPORT_SYMBOL_GPL(nf_ipv6_ops); + + DEFINE_PER_CPU(bool, nf_skb_duplicated); + EXPORT_SYMBOL_GPL(nf_skb_duplicated); + +-int nf_register_afinfo(const struct nf_afinfo *afinfo) +-{ +- mutex_lock(&afinfo_mutex); +- RCU_INIT_POINTER(nf_afinfo[afinfo->family], afinfo); +- mutex_unlock(&afinfo_mutex); +- return 0; +-} +-EXPORT_SYMBOL_GPL(nf_register_afinfo); +- +-void nf_unregister_afinfo(const struct nf_afinfo *afinfo) +-{ +- mutex_lock(&afinfo_mutex); +- RCU_INIT_POINTER(nf_afinfo[afinfo->family], NULL); +- mutex_unlock(&afinfo_mutex); +- synchronize_rcu(); +-} +-EXPORT_SYMBOL_GPL(nf_unregister_afinfo); +- + #ifdef HAVE_JUMP_LABEL + struct static_key nf_hooks_needed[NFPROTO_NUMPROTO][NF_MAX_HOOKS]; + EXPORT_SYMBOL(nf_hooks_needed); diff --git a/target/linux/generic/backport-4.19/311-v4.16-netfilter-nf_tables_arp-don-t-set-forward-chain.patch b/target/linux/generic/backport-4.19/311-v4.16-netfilter-nf_tables_arp-don-t-set-forward-chain.patch new file mode 100644 index 0000000000..10ce26dc8e --- /dev/null +++ b/target/linux/generic/backport-4.19/311-v4.16-netfilter-nf_tables_arp-don-t-set-forward-chain.patch @@ -0,0 +1,20 @@ +From: Pablo Neira Ayuso <pablo@netfilter.org> +Date: Sun, 10 Dec 2017 01:42:58 +0100 +Subject: [PATCH] netfilter: nf_tables_arp: don't set forward chain + +46928a0b49f3 ("netfilter: nf_tables: remove multihook chains and +families") already removed this, this is a leftover. + +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + +--- a/net/ipv4/netfilter/nf_tables_arp.c ++++ b/net/ipv4/netfilter/nf_tables_arp.c +@@ -34,7 +34,6 @@ static struct nft_af_info nft_af_arp __r + .hooks = { + [NF_ARP_IN] = nft_do_chain_arp, + [NF_ARP_OUT] = nft_do_chain_arp, +- [NF_ARP_FORWARD] = nft_do_chain_arp, + }, + }; + diff --git a/target/linux/generic/backport-4.19/312-v4.16-netfilter-nf_tables-remove-hooks-from-family-definit.patch b/target/linux/generic/backport-4.19/312-v4.16-netfilter-nf_tables-remove-hooks-from-family-definit.patch new file mode 100644 index 0000000000..3ee8ad9d33 --- /dev/null +++ b/target/linux/generic/backport-4.19/312-v4.16-netfilter-nf_tables-remove-hooks-from-family-definit.patch @@ -0,0 +1,233 @@ +From: Pablo Neira Ayuso <pablo@netfilter.org> +Date: Sat, 9 Dec 2017 15:43:17 +0100 +Subject: [PATCH] netfilter: nf_tables: remove hooks from family definition + +They don't belong to the family definition, move them to the filter +chain type definition instead. + +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + +--- a/include/net/netfilter/nf_tables.h ++++ b/include/net/netfilter/nf_tables.h +@@ -875,7 +875,7 @@ enum nft_chain_type { + * @family: address family + * @owner: module owner + * @hook_mask: mask of valid hooks +- * @hooks: hookfn overrides ++ * @hooks: array of hook functions + */ + struct nf_chain_type { + const char *name; +@@ -969,7 +969,6 @@ enum nft_af_flags { + * @owner: module owner + * @tables: used internally + * @flags: family flags +- * @hooks: hookfn overrides for packet validation + */ + struct nft_af_info { + struct list_head list; +@@ -978,7 +977,6 @@ struct nft_af_info { + struct module *owner; + struct list_head tables; + u32 flags; +- nf_hookfn *hooks[NF_MAX_HOOKS]; + }; + + int nft_register_afinfo(struct net *, struct nft_af_info *); +--- a/net/bridge/netfilter/nf_tables_bridge.c ++++ b/net/bridge/netfilter/nf_tables_bridge.c +@@ -46,13 +46,6 @@ static struct nft_af_info nft_af_bridge + .family = NFPROTO_BRIDGE, + .nhooks = NF_BR_NUMHOOKS, + .owner = THIS_MODULE, +- .hooks = { +- [NF_BR_PRE_ROUTING] = nft_do_chain_bridge, +- [NF_BR_LOCAL_IN] = nft_do_chain_bridge, +- [NF_BR_FORWARD] = nft_do_chain_bridge, +- [NF_BR_LOCAL_OUT] = nft_do_chain_bridge, +- [NF_BR_POST_ROUTING] = nft_do_chain_bridge, +- }, + }; + + static int nf_tables_bridge_init_net(struct net *net) +@@ -93,6 +86,13 @@ static const struct nf_chain_type filter + (1 << NF_BR_FORWARD) | + (1 << NF_BR_LOCAL_OUT) | + (1 << NF_BR_POST_ROUTING), ++ .hooks = { ++ [NF_BR_PRE_ROUTING] = nft_do_chain_bridge, ++ [NF_BR_LOCAL_IN] = nft_do_chain_bridge, ++ [NF_BR_FORWARD] = nft_do_chain_bridge, ++ [NF_BR_LOCAL_OUT] = nft_do_chain_bridge, ++ [NF_BR_POST_ROUTING] = nft_do_chain_bridge, ++ }, + }; + + static int __init nf_tables_bridge_init(void) +--- a/net/ipv4/netfilter/nf_tables_arp.c ++++ b/net/ipv4/netfilter/nf_tables_arp.c +@@ -31,10 +31,6 @@ static struct nft_af_info nft_af_arp __r + .family = NFPROTO_ARP, + .nhooks = NF_ARP_NUMHOOKS, + .owner = THIS_MODULE, +- .hooks = { +- [NF_ARP_IN] = nft_do_chain_arp, +- [NF_ARP_OUT] = nft_do_chain_arp, +- }, + }; + + static int nf_tables_arp_init_net(struct net *net) +@@ -72,6 +68,10 @@ static const struct nf_chain_type filter + .owner = THIS_MODULE, + .hook_mask = (1 << NF_ARP_IN) | + (1 << NF_ARP_OUT), ++ .hooks = { ++ [NF_ARP_IN] = nft_do_chain_arp, ++ [NF_ARP_OUT] = nft_do_chain_arp, ++ }, + }; + + static int __init nf_tables_arp_init(void) +--- a/net/ipv4/netfilter/nf_tables_ipv4.c ++++ b/net/ipv4/netfilter/nf_tables_ipv4.c +@@ -49,13 +49,6 @@ static struct nft_af_info nft_af_ipv4 __ + .family = NFPROTO_IPV4, + .nhooks = NF_INET_NUMHOOKS, + .owner = THIS_MODULE, +- .hooks = { +- [NF_INET_LOCAL_IN] = nft_do_chain_ipv4, +- [NF_INET_LOCAL_OUT] = nft_ipv4_output, +- [NF_INET_FORWARD] = nft_do_chain_ipv4, +- [NF_INET_PRE_ROUTING] = nft_do_chain_ipv4, +- [NF_INET_POST_ROUTING] = nft_do_chain_ipv4, +- }, + }; + + static int nf_tables_ipv4_init_net(struct net *net) +@@ -96,6 +89,13 @@ static const struct nf_chain_type filter + (1 << NF_INET_FORWARD) | + (1 << NF_INET_PRE_ROUTING) | + (1 << NF_INET_POST_ROUTING), ++ .hooks = { ++ [NF_INET_LOCAL_IN] = nft_do_chain_ipv4, ++ [NF_INET_LOCAL_OUT] = nft_ipv4_output, ++ [NF_INET_FORWARD] = nft_do_chain_ipv4, ++ [NF_INET_PRE_ROUTING] = nft_do_chain_ipv4, ++ [NF_INET_POST_ROUTING] = nft_do_chain_ipv4, ++ }, + }; + + static int __init nf_tables_ipv4_init(void) +--- a/net/ipv6/netfilter/nf_tables_ipv6.c ++++ b/net/ipv6/netfilter/nf_tables_ipv6.c +@@ -46,13 +46,6 @@ static struct nft_af_info nft_af_ipv6 __ + .family = NFPROTO_IPV6, + .nhooks = NF_INET_NUMHOOKS, + .owner = THIS_MODULE, +- .hooks = { +- [NF_INET_LOCAL_IN] = nft_do_chain_ipv6, +- [NF_INET_LOCAL_OUT] = nft_ipv6_output, +- [NF_INET_FORWARD] = nft_do_chain_ipv6, +- [NF_INET_PRE_ROUTING] = nft_do_chain_ipv6, +- [NF_INET_POST_ROUTING] = nft_do_chain_ipv6, +- }, + }; + + static int nf_tables_ipv6_init_net(struct net *net) +@@ -93,6 +86,13 @@ static const struct nf_chain_type filter + (1 << NF_INET_FORWARD) | + (1 << NF_INET_PRE_ROUTING) | + (1 << NF_INET_POST_ROUTING), ++ .hooks = { ++ [NF_INET_LOCAL_IN] = nft_do_chain_ipv6, ++ [NF_INET_LOCAL_OUT] = nft_ipv6_output, ++ [NF_INET_FORWARD] = nft_do_chain_ipv6, ++ [NF_INET_PRE_ROUTING] = nft_do_chain_ipv6, ++ [NF_INET_POST_ROUTING] = nft_do_chain_ipv6, ++ }, + }; + + static int __init nf_tables_ipv6_init(void) +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -1383,7 +1383,6 @@ static int nf_tables_addchain(struct nft + if (nla[NFTA_CHAIN_HOOK]) { + struct nft_chain_hook hook; + struct nf_hook_ops *ops; +- nf_hookfn *hookfn; + + err = nft_chain_parse_hook(net, nla, afi, &hook, create); + if (err < 0) +@@ -1409,7 +1408,6 @@ static int nf_tables_addchain(struct nft + static_branch_inc(&nft_counters_enabled); + } + +- hookfn = hook.type->hooks[hook.num]; + basechain->type = hook.type; + chain = &basechain->chain; + +@@ -1418,10 +1416,8 @@ static int nf_tables_addchain(struct nft + ops->hooknum = hook.num; + ops->priority = hook.priority; + ops->priv = chain; +- ops->hook = afi->hooks[ops->hooknum]; ++ ops->hook = hook.type->hooks[ops->hooknum]; + ops->dev = hook.dev; +- if (hookfn) +- ops->hook = hookfn; + + if (basechain->type->type == NFT_CHAIN_T_NAT) + ops->nat_hook = true; +--- a/net/netfilter/nf_tables_inet.c ++++ b/net/netfilter/nf_tables_inet.c +@@ -74,13 +74,6 @@ static struct nft_af_info nft_af_inet __ + .family = NFPROTO_INET, + .nhooks = NF_INET_NUMHOOKS, + .owner = THIS_MODULE, +- .hooks = { +- [NF_INET_LOCAL_IN] = nft_do_chain_inet, +- [NF_INET_LOCAL_OUT] = nft_inet_output, +- [NF_INET_FORWARD] = nft_do_chain_inet, +- [NF_INET_PRE_ROUTING] = nft_do_chain_inet, +- [NF_INET_POST_ROUTING] = nft_do_chain_inet, +- }, + }; + + static int __net_init nf_tables_inet_init_net(struct net *net) +@@ -121,6 +114,13 @@ static const struct nf_chain_type filter + (1 << NF_INET_FORWARD) | + (1 << NF_INET_PRE_ROUTING) | + (1 << NF_INET_POST_ROUTING), ++ .hooks = { ++ [NF_INET_LOCAL_IN] = nft_do_chain_inet, ++ [NF_INET_LOCAL_OUT] = nft_inet_output, ++ [NF_INET_FORWARD] = nft_do_chain_inet, ++ [NF_INET_PRE_ROUTING] = nft_do_chain_inet, ++ [NF_INET_POST_ROUTING] = nft_do_chain_inet, ++ }, + }; + + static int __init nf_tables_inet_init(void) +--- a/net/netfilter/nf_tables_netdev.c ++++ b/net/netfilter/nf_tables_netdev.c +@@ -43,9 +43,6 @@ static struct nft_af_info nft_af_netdev + .nhooks = NF_NETDEV_NUMHOOKS, + .owner = THIS_MODULE, + .flags = NFT_AF_NEEDS_DEV, +- .hooks = { +- [NF_NETDEV_INGRESS] = nft_do_chain_netdev, +- }, + }; + + static int nf_tables_netdev_init_net(struct net *net) +@@ -82,6 +79,9 @@ static const struct nf_chain_type nft_fi + .family = NFPROTO_NETDEV, + .owner = THIS_MODULE, + .hook_mask = (1 << NF_NETDEV_INGRESS), ++ .hooks = { ++ [NF_NETDEV_INGRESS] = nft_do_chain_netdev, ++ }, + }; + + static void nft_netdev_event(unsigned long event, struct net_device *dev, diff --git a/target/linux/generic/backport-4.19/313-v4.16-netfilter-remove-defensive-check-on-malformed-packet.patch b/target/linux/generic/backport-4.19/313-v4.16-netfilter-remove-defensive-check-on-malformed-packet.patch new file mode 100644 index 0000000000..5e56d0dc49 --- /dev/null +++ b/target/linux/generic/backport-4.19/313-v4.16-netfilter-remove-defensive-check-on-malformed-packet.patch @@ -0,0 +1,302 @@ +From: Pablo Neira Ayuso <pablo@netfilter.org> +Date: Sat, 30 Dec 2017 22:41:46 +0100 +Subject: [PATCH] netfilter: remove defensive check on malformed packets from + raw sockets + +Users cannot forge malformed IPv4/IPv6 headers via raw sockets that they +can inject into the stack. Specifically, not for IPv4 since 55888dfb6ba7 +("AF_RAW: Augment raw_send_hdrinc to expand skb to fit iphdr->ihl +(v2)"). IPv6 raw sockets also ensure that packets have a well-formed +IPv6 header available in the skbuff. + +At quick glance, br_netfilter also validates layer 3 headers and it +drops malformed both IPv4 and IPv6 packets. + +Therefore, let's remove this defensive check all over the place. + +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + +--- a/net/ipv4/netfilter/iptable_filter.c ++++ b/net/ipv4/netfilter/iptable_filter.c +@@ -38,12 +38,6 @@ static unsigned int + iptable_filter_hook(void *priv, struct sk_buff *skb, + const struct nf_hook_state *state) + { +- if (state->hook == NF_INET_LOCAL_OUT && +- (skb->len < sizeof(struct iphdr) || +- ip_hdrlen(skb) < sizeof(struct iphdr))) +- /* root is playing with raw sockets. */ +- return NF_ACCEPT; +- + return ipt_do_table(skb, state, state->net->ipv4.iptable_filter); + } + +--- a/net/ipv4/netfilter/iptable_mangle.c ++++ b/net/ipv4/netfilter/iptable_mangle.c +@@ -49,11 +49,6 @@ ipt_mangle_out(struct sk_buff *skb, cons + u_int32_t mark; + int err; + +- /* root is playing with raw sockets. */ +- if (skb->len < sizeof(struct iphdr) || +- ip_hdrlen(skb) < sizeof(struct iphdr)) +- return NF_ACCEPT; +- + /* Save things which could affect route */ + mark = skb->mark; + iph = ip_hdr(skb); +--- a/net/ipv4/netfilter/iptable_raw.c ++++ b/net/ipv4/netfilter/iptable_raw.c +@@ -26,12 +26,6 @@ static unsigned int + iptable_raw_hook(void *priv, struct sk_buff *skb, + const struct nf_hook_state *state) + { +- if (state->hook == NF_INET_LOCAL_OUT && +- (skb->len < sizeof(struct iphdr) || +- ip_hdrlen(skb) < sizeof(struct iphdr))) +- /* root is playing with raw sockets. */ +- return NF_ACCEPT; +- + return ipt_do_table(skb, state, state->net->ipv4.iptable_raw); + } + +--- a/net/ipv4/netfilter/iptable_security.c ++++ b/net/ipv4/netfilter/iptable_security.c +@@ -43,12 +43,6 @@ static unsigned int + iptable_security_hook(void *priv, struct sk_buff *skb, + const struct nf_hook_state *state) + { +- if (state->hook == NF_INET_LOCAL_OUT && +- (skb->len < sizeof(struct iphdr) || +- ip_hdrlen(skb) < sizeof(struct iphdr))) +- /* Somebody is playing with raw sockets. */ +- return NF_ACCEPT; +- + return ipt_do_table(skb, state, state->net->ipv4.iptable_security); + } + +--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c ++++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c +@@ -154,11 +154,6 @@ static unsigned int ipv4_conntrack_local + struct sk_buff *skb, + const struct nf_hook_state *state) + { +- /* root is playing with raw sockets. */ +- if (skb->len < sizeof(struct iphdr) || +- ip_hdrlen(skb) < sizeof(struct iphdr)) +- return NF_ACCEPT; +- + if (ip_is_fragment(ip_hdr(skb))) { /* IP_NODEFRAG setsockopt set */ + enum ip_conntrack_info ctinfo; + struct nf_conn *tmpl; +--- a/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c ++++ b/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c +@@ -355,11 +355,6 @@ nf_nat_ipv4_out(void *priv, struct sk_bu + #endif + unsigned int ret; + +- /* root is playing with raw sockets. */ +- if (skb->len < sizeof(struct iphdr) || +- ip_hdrlen(skb) < sizeof(struct iphdr)) +- return NF_ACCEPT; +- + ret = nf_nat_ipv4_fn(priv, skb, state, do_chain); + #ifdef CONFIG_XFRM + if (ret != NF_DROP && ret != NF_STOLEN && +@@ -395,11 +390,6 @@ nf_nat_ipv4_local_fn(void *priv, struct + unsigned int ret; + int err; + +- /* root is playing with raw sockets. */ +- if (skb->len < sizeof(struct iphdr) || +- ip_hdrlen(skb) < sizeof(struct iphdr)) +- return NF_ACCEPT; +- + ret = nf_nat_ipv4_fn(priv, skb, state, do_chain); + if (ret != NF_DROP && ret != NF_STOLEN && + (ct = nf_ct_get(skb, &ctinfo)) != NULL) { +--- a/net/ipv4/netfilter/nf_tables_ipv4.c ++++ b/net/ipv4/netfilter/nf_tables_ipv4.c +@@ -30,21 +30,6 @@ static unsigned int nft_do_chain_ipv4(vo + return nft_do_chain(&pkt, priv); + } + +-static unsigned int nft_ipv4_output(void *priv, +- struct sk_buff *skb, +- const struct nf_hook_state *state) +-{ +- if (unlikely(skb->len < sizeof(struct iphdr) || +- ip_hdr(skb)->ihl < sizeof(struct iphdr) / 4)) { +- if (net_ratelimit()) +- pr_info("nf_tables_ipv4: ignoring short SOCK_RAW " +- "packet\n"); +- return NF_ACCEPT; +- } +- +- return nft_do_chain_ipv4(priv, skb, state); +-} +- + static struct nft_af_info nft_af_ipv4 __read_mostly = { + .family = NFPROTO_IPV4, + .nhooks = NF_INET_NUMHOOKS, +@@ -91,7 +76,7 @@ static const struct nf_chain_type filter + (1 << NF_INET_POST_ROUTING), + .hooks = { + [NF_INET_LOCAL_IN] = nft_do_chain_ipv4, +- [NF_INET_LOCAL_OUT] = nft_ipv4_output, ++ [NF_INET_LOCAL_OUT] = nft_do_chain_ipv4, + [NF_INET_FORWARD] = nft_do_chain_ipv4, + [NF_INET_PRE_ROUTING] = nft_do_chain_ipv4, + [NF_INET_POST_ROUTING] = nft_do_chain_ipv4, +--- a/net/ipv4/netfilter/nft_chain_route_ipv4.c ++++ b/net/ipv4/netfilter/nft_chain_route_ipv4.c +@@ -33,11 +33,6 @@ static unsigned int nf_route_table_hook( + const struct iphdr *iph; + int err; + +- /* root is playing with raw sockets. */ +- if (skb->len < sizeof(struct iphdr) || +- ip_hdrlen(skb) < sizeof(struct iphdr)) +- return NF_ACCEPT; +- + nft_set_pktinfo(&pkt, skb, state); + nft_set_pktinfo_ipv4(&pkt, skb); + +--- a/net/ipv6/netfilter/ip6table_mangle.c ++++ b/net/ipv6/netfilter/ip6table_mangle.c +@@ -42,14 +42,6 @@ ip6t_mangle_out(struct sk_buff *skb, con + u_int8_t hop_limit; + u_int32_t flowlabel, mark; + int err; +-#if 0 +- /* root is playing with raw sockets. */ +- if (skb->len < sizeof(struct iphdr) || +- ip_hdrlen(skb) < sizeof(struct iphdr)) { +- net_warn_ratelimited("ip6t_hook: happy cracking\n"); +- return NF_ACCEPT; +- } +-#endif + + /* save source/dest address, mark, hoplimit, flowlabel, priority, */ + memcpy(&saddr, &ipv6_hdr(skb)->saddr, sizeof(saddr)); +--- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c ++++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c +@@ -176,11 +176,6 @@ static unsigned int ipv6_conntrack_local + struct sk_buff *skb, + const struct nf_hook_state *state) + { +- /* root is playing with raw sockets. */ +- if (skb->len < sizeof(struct ipv6hdr)) { +- net_notice_ratelimited("ipv6_conntrack_local: packet too short\n"); +- return NF_ACCEPT; +- } + return nf_conntrack_in(state->net, PF_INET6, state->hook, skb); + } + +--- a/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c ++++ b/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c +@@ -372,10 +372,6 @@ nf_nat_ipv6_out(void *priv, struct sk_bu + #endif + unsigned int ret; + +- /* root is playing with raw sockets. */ +- if (skb->len < sizeof(struct ipv6hdr)) +- return NF_ACCEPT; +- + ret = nf_nat_ipv6_fn(priv, skb, state, do_chain); + #ifdef CONFIG_XFRM + if (ret != NF_DROP && ret != NF_STOLEN && +@@ -411,10 +407,6 @@ nf_nat_ipv6_local_fn(void *priv, struct + unsigned int ret; + int err; + +- /* root is playing with raw sockets. */ +- if (skb->len < sizeof(struct ipv6hdr)) +- return NF_ACCEPT; +- + ret = nf_nat_ipv6_fn(priv, skb, state, do_chain); + if (ret != NF_DROP && ret != NF_STOLEN && + (ct = nf_ct_get(skb, &ctinfo)) != NULL) { +--- a/net/ipv6/netfilter/nf_tables_ipv6.c ++++ b/net/ipv6/netfilter/nf_tables_ipv6.c +@@ -28,20 +28,6 @@ static unsigned int nft_do_chain_ipv6(vo + return nft_do_chain(&pkt, priv); + } + +-static unsigned int nft_ipv6_output(void *priv, +- struct sk_buff *skb, +- const struct nf_hook_state *state) +-{ +- if (unlikely(skb->len < sizeof(struct ipv6hdr))) { +- if (net_ratelimit()) +- pr_info("nf_tables_ipv6: ignoring short SOCK_RAW " +- "packet\n"); +- return NF_ACCEPT; +- } +- +- return nft_do_chain_ipv6(priv, skb, state); +-} +- + static struct nft_af_info nft_af_ipv6 __read_mostly = { + .family = NFPROTO_IPV6, + .nhooks = NF_INET_NUMHOOKS, +@@ -88,7 +74,7 @@ static const struct nf_chain_type filter + (1 << NF_INET_POST_ROUTING), + .hooks = { + [NF_INET_LOCAL_IN] = nft_do_chain_ipv6, +- [NF_INET_LOCAL_OUT] = nft_ipv6_output, ++ [NF_INET_LOCAL_OUT] = nft_do_chain_ipv6, + [NF_INET_FORWARD] = nft_do_chain_ipv6, + [NF_INET_PRE_ROUTING] = nft_do_chain_ipv6, + [NF_INET_POST_ROUTING] = nft_do_chain_ipv6, +--- a/net/netfilter/nf_tables_inet.c ++++ b/net/netfilter/nf_tables_inet.c +@@ -38,38 +38,6 @@ static unsigned int nft_do_chain_inet(vo + return nft_do_chain(&pkt, priv); + } + +-static unsigned int nft_inet_output(void *priv, struct sk_buff *skb, +- const struct nf_hook_state *state) +-{ +- struct nft_pktinfo pkt; +- +- nft_set_pktinfo(&pkt, skb, state); +- +- switch (state->pf) { +- case NFPROTO_IPV4: +- if (unlikely(skb->len < sizeof(struct iphdr) || +- ip_hdr(skb)->ihl < sizeof(struct iphdr) / 4)) { +- if (net_ratelimit()) +- pr_info("ignoring short SOCK_RAW packet\n"); +- return NF_ACCEPT; +- } +- nft_set_pktinfo_ipv4(&pkt, skb); +- break; +- case NFPROTO_IPV6: +- if (unlikely(skb->len < sizeof(struct ipv6hdr))) { +- if (net_ratelimit()) +- pr_info("ignoring short SOCK_RAW packet\n"); +- return NF_ACCEPT; +- } +- nft_set_pktinfo_ipv6(&pkt, skb); +- break; +- default: +- break; +- } +- +- return nft_do_chain(&pkt, priv); +-} +- + static struct nft_af_info nft_af_inet __read_mostly = { + .family = NFPROTO_INET, + .nhooks = NF_INET_NUMHOOKS, +@@ -116,7 +84,7 @@ static const struct nf_chain_type filter + (1 << NF_INET_POST_ROUTING), + .hooks = { + [NF_INET_LOCAL_IN] = nft_do_chain_inet, +- [NF_INET_LOCAL_OUT] = nft_inet_output, ++ [NF_INET_LOCAL_OUT] = nft_do_chain_inet, + [NF_INET_FORWARD] = nft_do_chain_inet, + [NF_INET_PRE_ROUTING] = nft_do_chain_inet, + [NF_INET_POST_ROUTING] = nft_do_chain_inet, diff --git a/target/linux/generic/backport-4.19/314-v4.16-netfilter-meta-secpath-support.patch b/target/linux/generic/backport-4.19/314-v4.16-netfilter-meta-secpath-support.patch new file mode 100644 index 0000000000..7aab67fc2c --- /dev/null +++ b/target/linux/generic/backport-4.19/314-v4.16-netfilter-meta-secpath-support.patch @@ -0,0 +1,101 @@ +From: Florian Westphal <fw@strlen.de> +Date: Wed, 6 Dec 2017 16:18:16 +0100 +Subject: [PATCH] netfilter: meta: secpath support + +replacement for iptables "-m policy --dir in --policy {ipsec,none}". + +Signed-off-by: Florian Westphal <fw@strlen.de> +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + +--- a/include/uapi/linux/netfilter/nf_tables.h ++++ b/include/uapi/linux/netfilter/nf_tables.h +@@ -777,6 +777,7 @@ enum nft_exthdr_attributes { + * @NFT_META_OIFGROUP: packet output interface group + * @NFT_META_CGROUP: socket control group (skb->sk->sk_classid) + * @NFT_META_PRANDOM: a 32bit pseudo-random number ++ * @NFT_META_SECPATH: boolean, secpath_exists (!!skb->sp) + */ + enum nft_meta_keys { + NFT_META_LEN, +@@ -804,6 +805,7 @@ enum nft_meta_keys { + NFT_META_OIFGROUP, + NFT_META_CGROUP, + NFT_META_PRANDOM, ++ NFT_META_SECPATH, + }; + + /** +--- a/net/netfilter/nft_meta.c ++++ b/net/netfilter/nft_meta.c +@@ -210,6 +210,11 @@ void nft_meta_get_eval(const struct nft_ + *dest = prandom_u32_state(state); + break; + } ++#ifdef CONFIG_XFRM ++ case NFT_META_SECPATH: ++ nft_reg_store8(dest, !!skb->sp); ++ break; ++#endif + default: + WARN_ON(1); + goto err; +@@ -310,6 +315,11 @@ int nft_meta_get_init(const struct nft_c + prandom_init_once(&nft_prandom_state); + len = sizeof(u32); + break; ++#ifdef CONFIG_XFRM ++ case NFT_META_SECPATH: ++ len = sizeof(u8); ++ break; ++#endif + default: + return -EOPNOTSUPP; + } +@@ -320,6 +330,38 @@ int nft_meta_get_init(const struct nft_c + } + EXPORT_SYMBOL_GPL(nft_meta_get_init); + ++static int nft_meta_get_validate(const struct nft_ctx *ctx, ++ const struct nft_expr *expr, ++ const struct nft_data **data) ++{ ++#ifdef CONFIG_XFRM ++ const struct nft_meta *priv = nft_expr_priv(expr); ++ unsigned int hooks; ++ ++ if (priv->key != NFT_META_SECPATH) ++ return 0; ++ ++ switch (ctx->afi->family) { ++ case NFPROTO_NETDEV: ++ hooks = 1 << NF_NETDEV_INGRESS; ++ break; ++ case NFPROTO_IPV4: ++ case NFPROTO_IPV6: ++ case NFPROTO_INET: ++ hooks = (1 << NF_INET_PRE_ROUTING) | ++ (1 << NF_INET_LOCAL_IN) | ++ (1 << NF_INET_FORWARD); ++ break; ++ default: ++ return -EOPNOTSUPP; ++ } ++ ++ return nft_chain_validate_hooks(ctx->chain, hooks); ++#else ++ return 0; ++#endif ++} ++ + int nft_meta_set_validate(const struct nft_ctx *ctx, + const struct nft_expr *expr, + const struct nft_data **data) +@@ -436,6 +478,7 @@ static const struct nft_expr_ops nft_met + .eval = nft_meta_get_eval, + .init = nft_meta_get_init, + .dump = nft_meta_get_dump, ++ .validate = nft_meta_get_validate, + }; + + static const struct nft_expr_ops nft_meta_set_ops = { diff --git a/target/linux/generic/backport-4.19/315-v4.15-netfilter-conntrack-move-nf_ct_netns_-get-put-to-cor.patch b/target/linux/generic/backport-4.19/315-v4.15-netfilter-conntrack-move-nf_ct_netns_-get-put-to-cor.patch new file mode 100644 index 0000000000..7f6e90470a --- /dev/null +++ b/target/linux/generic/backport-4.19/315-v4.15-netfilter-conntrack-move-nf_ct_netns_-get-put-to-cor.patch @@ -0,0 +1,142 @@ +From: Pablo Neira Ayuso <pablo@netfilter.org> +Date: Fri, 3 Nov 2017 16:26:32 +0100 +Subject: [PATCH] netfilter: conntrack: move nf_ct_netns_{get,put}() to core + +So we can call this from other expression that need conntrack in place +to work. + +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +Acked-by: Florian Westphal <fw@strlen.de> +--- + +--- a/net/netfilter/nf_conntrack_proto.c ++++ b/net/netfilter/nf_conntrack_proto.c +@@ -125,7 +125,7 @@ void nf_ct_l3proto_module_put(unsigned s + } + EXPORT_SYMBOL_GPL(nf_ct_l3proto_module_put); + +-int nf_ct_netns_get(struct net *net, u8 nfproto) ++static int nf_ct_netns_do_get(struct net *net, u8 nfproto) + { + const struct nf_conntrack_l3proto *l3proto; + int ret; +@@ -150,9 +150,33 @@ int nf_ct_netns_get(struct net *net, u8 + + return ret; + } ++ ++int nf_ct_netns_get(struct net *net, u8 nfproto) ++{ ++ int err; ++ ++ if (nfproto == NFPROTO_INET) { ++ err = nf_ct_netns_do_get(net, NFPROTO_IPV4); ++ if (err < 0) ++ goto err1; ++ err = nf_ct_netns_do_get(net, NFPROTO_IPV6); ++ if (err < 0) ++ goto err2; ++ } else { ++ err = nf_ct_netns_do_get(net, nfproto); ++ if (err < 0) ++ goto err1; ++ } ++ return 0; ++ ++err2: ++ nf_ct_netns_put(net, NFPROTO_IPV4); ++err1: ++ return err; ++} + EXPORT_SYMBOL_GPL(nf_ct_netns_get); + +-void nf_ct_netns_put(struct net *net, u8 nfproto) ++static void nf_ct_netns_do_put(struct net *net, u8 nfproto) + { + const struct nf_conntrack_l3proto *l3proto; + +@@ -171,6 +195,15 @@ void nf_ct_netns_put(struct net *net, u8 + + nf_ct_l3proto_module_put(nfproto); + } ++ ++void nf_ct_netns_put(struct net *net, uint8_t nfproto) ++{ ++ if (nfproto == NFPROTO_INET) { ++ nf_ct_netns_do_put(net, NFPROTO_IPV4); ++ nf_ct_netns_do_put(net, NFPROTO_IPV6); ++ } else ++ nf_ct_netns_do_put(net, nfproto); ++} + EXPORT_SYMBOL_GPL(nf_ct_netns_put); + + const struct nf_conntrack_l4proto * +--- a/net/netfilter/nft_ct.c ++++ b/net/netfilter/nft_ct.c +@@ -312,39 +312,6 @@ static const struct nla_policy nft_ct_po + [NFTA_CT_SREG] = { .type = NLA_U32 }, + }; + +-static int nft_ct_netns_get(struct net *net, uint8_t family) +-{ +- int err; +- +- if (family == NFPROTO_INET) { +- err = nf_ct_netns_get(net, NFPROTO_IPV4); +- if (err < 0) +- goto err1; +- err = nf_ct_netns_get(net, NFPROTO_IPV6); +- if (err < 0) +- goto err2; +- } else { +- err = nf_ct_netns_get(net, family); +- if (err < 0) +- goto err1; +- } +- return 0; +- +-err2: +- nf_ct_netns_put(net, NFPROTO_IPV4); +-err1: +- return err; +-} +- +-static void nft_ct_netns_put(struct net *net, uint8_t family) +-{ +- if (family == NFPROTO_INET) { +- nf_ct_netns_put(net, NFPROTO_IPV4); +- nf_ct_netns_put(net, NFPROTO_IPV6); +- } else +- nf_ct_netns_put(net, family); +-} +- + #ifdef CONFIG_NF_CONNTRACK_ZONES + static void nft_ct_tmpl_put_pcpu(void) + { +@@ -489,7 +456,7 @@ static int nft_ct_get_init(const struct + if (err < 0) + return err; + +- err = nft_ct_netns_get(ctx->net, ctx->afi->family); ++ err = nf_ct_netns_get(ctx->net, ctx->afi->family); + if (err < 0) + return err; + +@@ -583,7 +550,7 @@ static int nft_ct_set_init(const struct + if (err < 0) + goto err1; + +- err = nft_ct_netns_get(ctx->net, ctx->afi->family); ++ err = nf_ct_netns_get(ctx->net, ctx->afi->family); + if (err < 0) + goto err1; + +@@ -606,7 +573,7 @@ static void nft_ct_set_destroy(const str + struct nft_ct *priv = nft_expr_priv(expr); + + __nft_ct_set_destroy(ctx, priv); +- nft_ct_netns_put(ctx->net, ctx->afi->family); ++ nf_ct_netns_put(ctx->net, ctx->afi->family); + } + + static int nft_ct_get_dump(struct sk_buff *skb, const struct nft_expr *expr) diff --git a/target/linux/generic/backport-4.19/320-v4.16-netfilter-nf_conntrack-add-IPS_OFFLOAD-status-bit.patch b/target/linux/generic/backport-4.19/320-v4.16-netfilter-nf_conntrack-add-IPS_OFFLOAD-status-bit.patch new file mode 100644 index 0000000000..7788dd1434 --- /dev/null +++ b/target/linux/generic/backport-4.19/320-v4.16-netfilter-nf_conntrack-add-IPS_OFFLOAD-status-bit.patch @@ -0,0 +1,169 @@ +From: Pablo Neira Ayuso <pablo@netfilter.org> +Date: Sun, 7 Jan 2018 01:03:56 +0100 +Subject: [PATCH] netfilter: nf_conntrack: add IPS_OFFLOAD status bit + +This new bit tells us that the conntrack entry is owned by the flow +table offload infrastructure. + + # cat /proc/net/nf_conntrack + ipv4 2 tcp 6 src=10.141.10.2 dst=147.75.205.195 sport=36392 dport=443 src=147.75.205.195 dst=192.168.2.195 sport=443 dport=36392 [OFFLOAD] mark=0 zone=0 use=2 + +Note the [OFFLOAD] tag in the listing. + +The timer of such conntrack entries look like stopped from userspace. +In practise, to make sure the conntrack entry does not go away, the +conntrack timer is periodically set to an arbitrary large value that +gets refreshed on every iteration from the garbage collector, so it +never expires- and they display no internal state in the case of TCP +flows. This allows us to save a bitcheck from the packet path via +nf_ct_is_expired(). + +Conntrack entries that have been offloaded to the flow table +infrastructure cannot be deleted/flushed via ctnetlink. The flow table +infrastructure is also responsible for releasing this conntrack entry. + +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + +--- a/include/uapi/linux/netfilter/nf_conntrack_common.h ++++ b/include/uapi/linux/netfilter/nf_conntrack_common.h +@@ -101,12 +101,16 @@ enum ip_conntrack_status { + IPS_HELPER_BIT = 13, + IPS_HELPER = (1 << IPS_HELPER_BIT), + ++ /* Conntrack has been offloaded to flow table. */ ++ IPS_OFFLOAD_BIT = 14, ++ IPS_OFFLOAD = (1 << IPS_OFFLOAD_BIT), ++ + /* Be careful here, modifying these bits can make things messy, + * so don't let users modify them directly. + */ + IPS_UNCHANGEABLE_MASK = (IPS_NAT_DONE_MASK | IPS_NAT_MASK | + IPS_EXPECTED | IPS_CONFIRMED | IPS_DYING | +- IPS_SEQ_ADJUST | IPS_TEMPLATE), ++ IPS_SEQ_ADJUST | IPS_TEMPLATE | IPS_OFFLOAD), + + __IPS_MAX_BIT = 14, + }; +--- a/net/netfilter/nf_conntrack_core.c ++++ b/net/netfilter/nf_conntrack_core.c +@@ -901,6 +901,9 @@ static unsigned int early_drop_list(stru + hlist_nulls_for_each_entry_rcu(h, n, head, hnnode) { + tmp = nf_ct_tuplehash_to_ctrack(h); + ++ if (test_bit(IPS_OFFLOAD_BIT, &tmp->status)) ++ continue; ++ + if (nf_ct_is_expired(tmp)) { + nf_ct_gc_expired(tmp); + continue; +@@ -978,6 +981,18 @@ static bool gc_worker_can_early_drop(con + return false; + } + ++#define DAY (86400 * HZ) ++ ++/* Set an arbitrary timeout large enough not to ever expire, this save ++ * us a check for the IPS_OFFLOAD_BIT from the packet path via ++ * nf_ct_is_expired(). ++ */ ++static void nf_ct_offload_timeout(struct nf_conn *ct) ++{ ++ if (nf_ct_expires(ct) < DAY / 2) ++ ct->timeout = nfct_time_stamp + DAY; ++} ++ + static void gc_worker(struct work_struct *work) + { + unsigned int min_interval = max(HZ / GC_MAX_BUCKETS_DIV, 1u); +@@ -1014,6 +1029,11 @@ static void gc_worker(struct work_struct + tmp = nf_ct_tuplehash_to_ctrack(h); + + scanned++; ++ if (test_bit(IPS_OFFLOAD_BIT, &tmp->status)) { ++ nf_ct_offload_timeout(tmp); ++ continue; ++ } ++ + if (nf_ct_is_expired(tmp)) { + nf_ct_gc_expired(tmp); + expired_count++; +--- a/net/netfilter/nf_conntrack_netlink.c ++++ b/net/netfilter/nf_conntrack_netlink.c +@@ -1120,6 +1120,14 @@ static const struct nla_policy ct_nla_po + .len = NF_CT_LABELS_MAX_SIZE }, + }; + ++static int ctnetlink_flush_iterate(struct nf_conn *ct, void *data) ++{ ++ if (test_bit(IPS_OFFLOAD_BIT, &ct->status)) ++ return 0; ++ ++ return ctnetlink_filter_match(ct, data); ++} ++ + static int ctnetlink_flush_conntrack(struct net *net, + const struct nlattr * const cda[], + u32 portid, int report) +@@ -1132,7 +1140,7 @@ static int ctnetlink_flush_conntrack(str + return PTR_ERR(filter); + } + +- nf_ct_iterate_cleanup_net(net, ctnetlink_filter_match, filter, ++ nf_ct_iterate_cleanup_net(net, ctnetlink_flush_iterate, filter, + portid, report); + kfree(filter); + +@@ -1178,6 +1186,11 @@ static int ctnetlink_del_conntrack(struc + + ct = nf_ct_tuplehash_to_ctrack(h); + ++ if (test_bit(IPS_OFFLOAD_BIT, &ct->status)) { ++ nf_ct_put(ct); ++ return -EBUSY; ++ } ++ + if (cda[CTA_ID]) { + u_int32_t id = ntohl(nla_get_be32(cda[CTA_ID])); + if (id != (u32)(unsigned long)ct) { +--- a/net/netfilter/nf_conntrack_proto_tcp.c ++++ b/net/netfilter/nf_conntrack_proto_tcp.c +@@ -305,6 +305,9 @@ static bool tcp_invert_tuple(struct nf_c + /* Print out the private part of the conntrack. */ + static void tcp_print_conntrack(struct seq_file *s, struct nf_conn *ct) + { ++ if (test_bit(IPS_OFFLOAD_BIT, &ct->status)) ++ return; ++ + seq_printf(s, "%s ", tcp_conntrack_names[ct->proto.tcp.state]); + } + #endif +--- a/net/netfilter/nf_conntrack_standalone.c ++++ b/net/netfilter/nf_conntrack_standalone.c +@@ -309,10 +309,12 @@ static int ct_seq_show(struct seq_file * + WARN_ON(!l4proto); + + ret = -ENOSPC; +- seq_printf(s, "%-8s %u %-8s %u %ld ", ++ seq_printf(s, "%-8s %u %-8s %u ", + l3proto_name(l3proto->l3proto), nf_ct_l3num(ct), +- l4proto_name(l4proto->l4proto), nf_ct_protonum(ct), +- nf_ct_expires(ct) / HZ); ++ l4proto_name(l4proto->l4proto), nf_ct_protonum(ct)); ++ ++ if (!test_bit(IPS_OFFLOAD_BIT, &ct->status)) ++ seq_printf(s, "%ld ", nf_ct_expires(ct) / HZ); + + if (l4proto->print_conntrack) + l4proto->print_conntrack(s, ct); +@@ -339,7 +341,9 @@ static int ct_seq_show(struct seq_file * + if (seq_print_acct(s, ct, IP_CT_DIR_REPLY)) + goto release; + +- if (test_bit(IPS_ASSURED_BIT, &ct->status)) ++ if (test_bit(IPS_OFFLOAD_BIT, &ct->status)) ++ seq_puts(s, "[OFFLOAD] "); ++ else if (test_bit(IPS_ASSURED_BIT, &ct->status)) + seq_puts(s, "[ASSURED] "); + + if (seq_has_overflowed(s)) diff --git a/target/linux/generic/backport-4.19/321-v4.16-netfilter-nf_tables-add-flow-table-netlink-frontend.patch b/target/linux/generic/backport-4.19/321-v4.16-netfilter-nf_tables-add-flow-table-netlink-frontend.patch new file mode 100644 index 0000000000..1c16bbae4e --- /dev/null +++ b/target/linux/generic/backport-4.19/321-v4.16-netfilter-nf_tables-add-flow-table-netlink-frontend.patch @@ -0,0 +1,1079 @@ +From: Pablo Neira Ayuso <pablo@netfilter.org> +Date: Sun, 7 Jan 2018 01:04:07 +0100 +Subject: [PATCH] netfilter: nf_tables: add flow table netlink frontend + +This patch introduces a netlink control plane to create, delete and dump +flow tables. Flow tables are identified by name, this name is used from +rules to refer to an specific flow table. Flow tables use the rhashtable +class and a generic garbage collector to remove expired entries. + +This also adds the infrastructure to add different flow table types, so +we can add one for each layer 3 protocol family. + +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + create mode 100644 include/net/netfilter/nf_flow_table.h + +--- /dev/null ++++ b/include/net/netfilter/nf_flow_table.h +@@ -0,0 +1,23 @@ ++#ifndef _NF_FLOW_TABLE_H ++#define _NF_FLOW_TABLE_H ++ ++#include <linux/rhashtable.h> ++ ++struct nf_flowtable; ++ ++struct nf_flowtable_type { ++ struct list_head list; ++ int family; ++ void (*gc)(struct work_struct *work); ++ const struct rhashtable_params *params; ++ nf_hookfn *hook; ++ struct module *owner; ++}; ++ ++struct nf_flowtable { ++ struct rhashtable rhashtable; ++ const struct nf_flowtable_type *type; ++ struct delayed_work gc_work; ++}; ++ ++#endif /* _FLOW_OFFLOAD_H */ +--- a/include/net/netfilter/nf_tables.h ++++ b/include/net/netfilter/nf_tables.h +@@ -9,6 +9,7 @@ + #include <linux/netfilter/x_tables.h> + #include <linux/netfilter/nf_tables.h> + #include <linux/u64_stats_sync.h> ++#include <net/netfilter/nf_flow_table.h> + #include <net/netlink.h> + + #define NFT_JUMP_STACK_SIZE 16 +@@ -938,6 +939,7 @@ unsigned int nft_do_chain(struct nft_pkt + * @chains: chains in the table + * @sets: sets in the table + * @objects: stateful objects in the table ++ * @flowtables: flow tables in the table + * @hgenerator: handle generator state + * @use: number of chain references to this table + * @flags: table flag (see enum nft_table_flags) +@@ -949,6 +951,7 @@ struct nft_table { + struct list_head chains; + struct list_head sets; + struct list_head objects; ++ struct list_head flowtables; + u64 hgenerator; + u32 use; + u16 flags:14, +@@ -1080,6 +1083,44 @@ int nft_register_obj(struct nft_object_t + void nft_unregister_obj(struct nft_object_type *obj_type); + + /** ++ * struct nft_flowtable - nf_tables flow table ++ * ++ * @list: flow table list node in table list ++ * @table: the table the flow table is contained in ++ * @name: name of this flow table ++ * @hooknum: hook number ++ * @priority: hook priority ++ * @ops_len: number of hooks in array ++ * @genmask: generation mask ++ * @use: number of references to this flow table ++ * @data: rhashtable and garbage collector ++ * @ops: array of hooks ++ */ ++struct nft_flowtable { ++ struct list_head list; ++ struct nft_table *table; ++ char *name; ++ int hooknum; ++ int priority; ++ int ops_len; ++ u32 genmask:2, ++ use:30; ++ /* runtime data below here */ ++ struct nf_hook_ops *ops ____cacheline_aligned; ++ struct nf_flowtable data; ++}; ++ ++struct nft_flowtable *nf_tables_flowtable_lookup(const struct nft_table *table, ++ const struct nlattr *nla, ++ u8 genmask); ++void nft_flow_table_iterate(struct net *net, ++ void (*iter)(struct nf_flowtable *flowtable, void *data), ++ void *data); ++ ++void nft_register_flowtable_type(struct nf_flowtable_type *type); ++void nft_unregister_flowtable_type(struct nf_flowtable_type *type); ++ ++/** + * struct nft_traceinfo - nft tracing information and state + * + * @pkt: pktinfo currently processed +@@ -1315,4 +1356,11 @@ struct nft_trans_obj { + #define nft_trans_obj(trans) \ + (((struct nft_trans_obj *)trans->data)->obj) + ++struct nft_trans_flowtable { ++ struct nft_flowtable *flowtable; ++}; ++ ++#define nft_trans_flowtable(trans) \ ++ (((struct nft_trans_flowtable *)trans->data)->flowtable) ++ + #endif /* _NET_NF_TABLES_H */ +--- a/include/uapi/linux/netfilter/nf_tables.h ++++ b/include/uapi/linux/netfilter/nf_tables.h +@@ -92,6 +92,9 @@ enum nft_verdicts { + * @NFT_MSG_GETOBJ: get a stateful object (enum nft_obj_attributes) + * @NFT_MSG_DELOBJ: delete a stateful object (enum nft_obj_attributes) + * @NFT_MSG_GETOBJ_RESET: get and reset a stateful object (enum nft_obj_attributes) ++ * @NFT_MSG_NEWFLOWTABLE: add new flow table (enum nft_flowtable_attributes) ++ * @NFT_MSG_GETFLOWTABLE: get flow table (enum nft_flowtable_attributes) ++ * @NFT_MSG_DELFLOWTABLE: delete flow table (enum nft_flowtable_attributes) + */ + enum nf_tables_msg_types { + NFT_MSG_NEWTABLE, +@@ -116,6 +119,9 @@ enum nf_tables_msg_types { + NFT_MSG_GETOBJ, + NFT_MSG_DELOBJ, + NFT_MSG_GETOBJ_RESET, ++ NFT_MSG_NEWFLOWTABLE, ++ NFT_MSG_GETFLOWTABLE, ++ NFT_MSG_DELFLOWTABLE, + NFT_MSG_MAX, + }; + +@@ -1310,6 +1316,53 @@ enum nft_object_attributes { + #define NFTA_OBJ_MAX (__NFTA_OBJ_MAX - 1) + + /** ++ * enum nft_flowtable_attributes - nf_tables flow table netlink attributes ++ * ++ * @NFTA_FLOWTABLE_TABLE: name of the table containing the expression (NLA_STRING) ++ * @NFTA_FLOWTABLE_NAME: name of this flow table (NLA_STRING) ++ * @NFTA_FLOWTABLE_HOOK: netfilter hook configuration(NLA_U32) ++ * @NFTA_FLOWTABLE_USE: number of references to this flow table (NLA_U32) ++ */ ++enum nft_flowtable_attributes { ++ NFTA_FLOWTABLE_UNSPEC, ++ NFTA_FLOWTABLE_TABLE, ++ NFTA_FLOWTABLE_NAME, ++ NFTA_FLOWTABLE_HOOK, ++ NFTA_FLOWTABLE_USE, ++ __NFTA_FLOWTABLE_MAX ++}; ++#define NFTA_FLOWTABLE_MAX (__NFTA_FLOWTABLE_MAX - 1) ++ ++/** ++ * enum nft_flowtable_hook_attributes - nf_tables flow table hook netlink attributes ++ * ++ * @NFTA_FLOWTABLE_HOOK_NUM: netfilter hook number (NLA_U32) ++ * @NFTA_FLOWTABLE_HOOK_PRIORITY: netfilter hook priority (NLA_U32) ++ * @NFTA_FLOWTABLE_HOOK_DEVS: input devices this flow table is bound to (NLA_NESTED) ++ */ ++enum nft_flowtable_hook_attributes { ++ NFTA_FLOWTABLE_HOOK_UNSPEC, ++ NFTA_FLOWTABLE_HOOK_NUM, ++ NFTA_FLOWTABLE_HOOK_PRIORITY, ++ NFTA_FLOWTABLE_HOOK_DEVS, ++ __NFTA_FLOWTABLE_HOOK_MAX ++}; ++#define NFTA_FLOWTABLE_HOOK_MAX (__NFTA_FLOWTABLE_HOOK_MAX - 1) ++ ++/** ++ * enum nft_device_attributes - nf_tables device netlink attributes ++ * ++ * @NFTA_DEVICE_NAME: name of this device (NLA_STRING) ++ */ ++enum nft_devices_attributes { ++ NFTA_DEVICE_UNSPEC, ++ NFTA_DEVICE_NAME, ++ __NFTA_DEVICE_MAX ++}; ++#define NFTA_DEVICE_MAX (__NFTA_DEVICE_MAX - 1) ++ ++ ++/** + * enum nft_trace_attributes - nf_tables trace netlink attributes + * + * @NFTA_TRACE_TABLE: name of the table (NLA_STRING) +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -17,6 +17,7 @@ + #include <linux/netfilter.h> + #include <linux/netfilter/nfnetlink.h> + #include <linux/netfilter/nf_tables.h> ++#include <net/netfilter/nf_flow_table.h> + #include <net/netfilter/nf_tables_core.h> + #include <net/netfilter/nf_tables.h> + #include <net/net_namespace.h> +@@ -24,6 +25,7 @@ + + static LIST_HEAD(nf_tables_expressions); + static LIST_HEAD(nf_tables_objects); ++static LIST_HEAD(nf_tables_flowtables); + + /** + * nft_register_afinfo - register nf_tables address family info +@@ -374,6 +376,40 @@ static int nft_delobj(struct nft_ctx *ct + return err; + } + ++static int nft_trans_flowtable_add(struct nft_ctx *ctx, int msg_type, ++ struct nft_flowtable *flowtable) ++{ ++ struct nft_trans *trans; ++ ++ trans = nft_trans_alloc(ctx, msg_type, ++ sizeof(struct nft_trans_flowtable)); ++ if (trans == NULL) ++ return -ENOMEM; ++ ++ if (msg_type == NFT_MSG_NEWFLOWTABLE) ++ nft_activate_next(ctx->net, flowtable); ++ ++ nft_trans_flowtable(trans) = flowtable; ++ list_add_tail(&trans->list, &ctx->net->nft.commit_list); ++ ++ return 0; ++} ++ ++static int nft_delflowtable(struct nft_ctx *ctx, ++ struct nft_flowtable *flowtable) ++{ ++ int err; ++ ++ err = nft_trans_flowtable_add(ctx, NFT_MSG_DELFLOWTABLE, flowtable); ++ if (err < 0) ++ return err; ++ ++ nft_deactivate_next(ctx->net, flowtable); ++ ctx->table->use--; ++ ++ return err; ++} ++ + /* + * Tables + */ +@@ -757,6 +793,7 @@ static int nf_tables_newtable(struct net + INIT_LIST_HEAD(&table->chains); + INIT_LIST_HEAD(&table->sets); + INIT_LIST_HEAD(&table->objects); ++ INIT_LIST_HEAD(&table->flowtables); + table->flags = flags; + + nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla); +@@ -778,10 +815,11 @@ err1: + + static int nft_flush_table(struct nft_ctx *ctx) + { +- int err; ++ struct nft_flowtable *flowtable, *nft; + struct nft_chain *chain, *nc; + struct nft_object *obj, *ne; + struct nft_set *set, *ns; ++ int err; + + list_for_each_entry(chain, &ctx->table->chains, list) { + if (!nft_is_active_next(ctx->net, chain)) +@@ -807,6 +845,12 @@ static int nft_flush_table(struct nft_ct + goto out; + } + ++ list_for_each_entry_safe(flowtable, nft, &ctx->table->flowtables, list) { ++ err = nft_delflowtable(ctx, flowtable); ++ if (err < 0) ++ goto out; ++ } ++ + list_for_each_entry_safe(obj, ne, &ctx->table->objects, list) { + err = nft_delobj(ctx, obj); + if (err < 0) +@@ -4835,6 +4879,605 @@ static void nf_tables_obj_notify(const s + ctx->afi->family, ctx->report, GFP_KERNEL); + } + ++/* ++ * Flow tables ++ */ ++void nft_register_flowtable_type(struct nf_flowtable_type *type) ++{ ++ nfnl_lock(NFNL_SUBSYS_NFTABLES); ++ list_add_tail_rcu(&type->list, &nf_tables_flowtables); ++ nfnl_unlock(NFNL_SUBSYS_NFTABLES); ++} ++EXPORT_SYMBOL_GPL(nft_register_flowtable_type); ++ ++void nft_unregister_flowtable_type(struct nf_flowtable_type *type) ++{ ++ nfnl_lock(NFNL_SUBSYS_NFTABLES); ++ list_del_rcu(&type->list); ++ nfnl_unlock(NFNL_SUBSYS_NFTABLES); ++} ++EXPORT_SYMBOL_GPL(nft_unregister_flowtable_type); ++ ++static const struct nla_policy nft_flowtable_policy[NFTA_FLOWTABLE_MAX + 1] = { ++ [NFTA_FLOWTABLE_TABLE] = { .type = NLA_STRING, ++ .len = NFT_NAME_MAXLEN - 1 }, ++ [NFTA_FLOWTABLE_NAME] = { .type = NLA_STRING, ++ .len = NFT_NAME_MAXLEN - 1 }, ++ [NFTA_FLOWTABLE_HOOK] = { .type = NLA_NESTED }, ++}; ++ ++struct nft_flowtable *nf_tables_flowtable_lookup(const struct nft_table *table, ++ const struct nlattr *nla, ++ u8 genmask) ++{ ++ struct nft_flowtable *flowtable; ++ ++ list_for_each_entry(flowtable, &table->flowtables, list) { ++ if (!nla_strcmp(nla, flowtable->name) && ++ nft_active_genmask(flowtable, genmask)) ++ return flowtable; ++ } ++ return ERR_PTR(-ENOENT); ++} ++EXPORT_SYMBOL_GPL(nf_tables_flowtable_lookup); ++ ++#define NFT_FLOWTABLE_DEVICE_MAX 8 ++ ++static int nf_tables_parse_devices(const struct nft_ctx *ctx, ++ const struct nlattr *attr, ++ struct net_device *dev_array[], int *len) ++{ ++ const struct nlattr *tmp; ++ struct net_device *dev; ++ char ifname[IFNAMSIZ]; ++ int rem, n = 0, err; ++ ++ nla_for_each_nested(tmp, attr, rem) { ++ if (nla_type(tmp) != NFTA_DEVICE_NAME) { ++ err = -EINVAL; ++ goto err1; ++ } ++ ++ nla_strlcpy(ifname, tmp, IFNAMSIZ); ++ dev = dev_get_by_name(ctx->net, ifname); ++ if (!dev) { ++ err = -ENOENT; ++ goto err1; ++ } ++ ++ dev_array[n++] = dev; ++ if (n == NFT_FLOWTABLE_DEVICE_MAX) { ++ err = -EFBIG; ++ goto err1; ++ } ++ } ++ if (!len) ++ return -EINVAL; ++ ++ err = 0; ++err1: ++ *len = n; ++ return err; ++} ++ ++static const struct nla_policy nft_flowtable_hook_policy[NFTA_FLOWTABLE_HOOK_MAX + 1] = { ++ [NFTA_FLOWTABLE_HOOK_NUM] = { .type = NLA_U32 }, ++ [NFTA_FLOWTABLE_HOOK_PRIORITY] = { .type = NLA_U32 }, ++ [NFTA_FLOWTABLE_HOOK_DEVS] = { .type = NLA_NESTED }, ++}; ++ ++static int nf_tables_flowtable_parse_hook(const struct nft_ctx *ctx, ++ const struct nlattr *attr, ++ struct nft_flowtable *flowtable) ++{ ++ struct net_device *dev_array[NFT_FLOWTABLE_DEVICE_MAX]; ++ struct nlattr *tb[NFTA_FLOWTABLE_HOOK_MAX + 1]; ++ struct nf_hook_ops *ops; ++ int hooknum, priority; ++ int err, n = 0, i; ++ ++ err = nla_parse_nested(tb, NFTA_FLOWTABLE_HOOK_MAX, attr, ++ nft_flowtable_hook_policy, NULL); ++ if (err < 0) ++ return err; ++ ++ if (!tb[NFTA_FLOWTABLE_HOOK_NUM] || ++ !tb[NFTA_FLOWTABLE_HOOK_PRIORITY] || ++ !tb[NFTA_FLOWTABLE_HOOK_DEVS]) ++ return -EINVAL; ++ ++ hooknum = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_NUM])); ++ if (hooknum >= ctx->afi->nhooks) ++ return -EINVAL; ++ ++ priority = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_PRIORITY])); ++ ++ err = nf_tables_parse_devices(ctx, tb[NFTA_FLOWTABLE_HOOK_DEVS], ++ dev_array, &n); ++ if (err < 0) ++ goto err1; ++ ++ ops = kzalloc(sizeof(struct nf_hook_ops) * n, GFP_KERNEL); ++ if (!ops) { ++ err = -ENOMEM; ++ goto err1; ++ } ++ ++ flowtable->ops = ops; ++ flowtable->ops_len = n; ++ ++ for (i = 0; i < n; i++) { ++ flowtable->ops[i].pf = NFPROTO_NETDEV; ++ flowtable->ops[i].hooknum = hooknum; ++ flowtable->ops[i].priority = priority; ++ flowtable->ops[i].priv = &flowtable->data.rhashtable; ++ flowtable->ops[i].hook = flowtable->data.type->hook; ++ flowtable->ops[i].dev = dev_array[i]; ++ } ++ ++ err = 0; ++err1: ++ for (i = 0; i < n; i++) ++ dev_put(dev_array[i]); ++ ++ return err; ++} ++ ++static const struct nf_flowtable_type * ++__nft_flowtable_type_get(const struct nft_af_info *afi) ++{ ++ const struct nf_flowtable_type *type; ++ ++ list_for_each_entry(type, &nf_tables_flowtables, list) { ++ if (afi->family == type->family) ++ return type; ++ } ++ return NULL; ++} ++ ++static const struct nf_flowtable_type * ++nft_flowtable_type_get(const struct nft_af_info *afi) ++{ ++ const struct nf_flowtable_type *type; ++ ++ type = __nft_flowtable_type_get(afi); ++ if (type != NULL && try_module_get(type->owner)) ++ return type; ++ ++#ifdef CONFIG_MODULES ++ if (type == NULL) { ++ nfnl_unlock(NFNL_SUBSYS_NFTABLES); ++ request_module("nf-flowtable-%u", afi->family); ++ nfnl_lock(NFNL_SUBSYS_NFTABLES); ++ if (__nft_flowtable_type_get(afi)) ++ return ERR_PTR(-EAGAIN); ++ } ++#endif ++ return ERR_PTR(-ENOENT); ++} ++ ++void nft_flow_table_iterate(struct net *net, ++ void (*iter)(struct nf_flowtable *flowtable, void *data), ++ void *data) ++{ ++ struct nft_flowtable *flowtable; ++ const struct nft_af_info *afi; ++ const struct nft_table *table; ++ ++ rcu_read_lock(); ++ list_for_each_entry_rcu(afi, &net->nft.af_info, list) { ++ list_for_each_entry_rcu(table, &afi->tables, list) { ++ list_for_each_entry_rcu(flowtable, &table->flowtables, list) { ++ iter(&flowtable->data, data); ++ } ++ } ++ } ++ rcu_read_unlock(); ++} ++EXPORT_SYMBOL_GPL(nft_flow_table_iterate); ++ ++static void nft_unregister_flowtable_net_hooks(struct net *net, ++ struct nft_flowtable *flowtable) ++{ ++ int i; ++ ++ for (i = 0; i < flowtable->ops_len; i++) { ++ if (!flowtable->ops[i].dev) ++ continue; ++ ++ nf_unregister_net_hook(net, &flowtable->ops[i]); ++ } ++} ++ ++static int nf_tables_newflowtable(struct net *net, struct sock *nlsk, ++ struct sk_buff *skb, ++ const struct nlmsghdr *nlh, ++ const struct nlattr * const nla[], ++ struct netlink_ext_ack *extack) ++{ ++ const struct nfgenmsg *nfmsg = nlmsg_data(nlh); ++ const struct nf_flowtable_type *type; ++ u8 genmask = nft_genmask_next(net); ++ int family = nfmsg->nfgen_family; ++ struct nft_flowtable *flowtable; ++ struct nft_af_info *afi; ++ struct nft_table *table; ++ struct nft_ctx ctx; ++ int err, i, k; ++ ++ if (!nla[NFTA_FLOWTABLE_TABLE] || ++ !nla[NFTA_FLOWTABLE_NAME] || ++ !nla[NFTA_FLOWTABLE_HOOK]) ++ return -EINVAL; ++ ++ afi = nf_tables_afinfo_lookup(net, family, true); ++ if (IS_ERR(afi)) ++ return PTR_ERR(afi); ++ ++ table = nf_tables_table_lookup(afi, nla[NFTA_FLOWTABLE_TABLE], genmask); ++ if (IS_ERR(table)) ++ return PTR_ERR(table); ++ ++ flowtable = nf_tables_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME], ++ genmask); ++ if (IS_ERR(flowtable)) { ++ err = PTR_ERR(flowtable); ++ if (err != -ENOENT) ++ return err; ++ } else { ++ if (nlh->nlmsg_flags & NLM_F_EXCL) ++ return -EEXIST; ++ ++ return 0; ++ } ++ ++ nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla); ++ ++ flowtable = kzalloc(sizeof(*flowtable), GFP_KERNEL); ++ if (!flowtable) ++ return -ENOMEM; ++ ++ flowtable->table = table; ++ flowtable->name = nla_strdup(nla[NFTA_FLOWTABLE_NAME], GFP_KERNEL); ++ if (!flowtable->name) { ++ err = -ENOMEM; ++ goto err1; ++ } ++ ++ type = nft_flowtable_type_get(afi); ++ if (IS_ERR(type)) { ++ err = PTR_ERR(type); ++ goto err2; ++ } ++ ++ flowtable->data.type = type; ++ err = rhashtable_init(&flowtable->data.rhashtable, type->params); ++ if (err < 0) ++ goto err3; ++ ++ err = nf_tables_flowtable_parse_hook(&ctx, nla[NFTA_FLOWTABLE_HOOK], ++ flowtable); ++ if (err < 0) ++ goto err3; ++ ++ for (i = 0; i < flowtable->ops_len; i++) { ++ err = nf_register_net_hook(net, &flowtable->ops[i]); ++ if (err < 0) ++ goto err4; ++ } ++ ++ err = nft_trans_flowtable_add(&ctx, NFT_MSG_NEWFLOWTABLE, flowtable); ++ if (err < 0) ++ goto err5; ++ ++ INIT_DEFERRABLE_WORK(&flowtable->data.gc_work, type->gc); ++ queue_delayed_work(system_power_efficient_wq, ++ &flowtable->data.gc_work, HZ); ++ ++ list_add_tail_rcu(&flowtable->list, &table->flowtables); ++ table->use++; ++ ++ return 0; ++err5: ++ i = flowtable->ops_len; ++err4: ++ for (k = i - 1; k >= 0; k--) ++ nf_unregister_net_hook(net, &flowtable->ops[i]); ++ ++ kfree(flowtable->ops); ++err3: ++ module_put(type->owner); ++err2: ++ kfree(flowtable->name); ++err1: ++ kfree(flowtable); ++ return err; ++} ++ ++static int nf_tables_delflowtable(struct net *net, struct sock *nlsk, ++ struct sk_buff *skb, ++ const struct nlmsghdr *nlh, ++ const struct nlattr * const nla[], ++ struct netlink_ext_ack *extack) ++{ ++ const struct nfgenmsg *nfmsg = nlmsg_data(nlh); ++ u8 genmask = nft_genmask_next(net); ++ int family = nfmsg->nfgen_family; ++ struct nft_flowtable *flowtable; ++ struct nft_af_info *afi; ++ struct nft_table *table; ++ struct nft_ctx ctx; ++ ++ afi = nf_tables_afinfo_lookup(net, family, true); ++ if (IS_ERR(afi)) ++ return PTR_ERR(afi); ++ ++ table = nf_tables_table_lookup(afi, nla[NFTA_FLOWTABLE_TABLE], genmask); ++ if (IS_ERR(table)) ++ return PTR_ERR(table); ++ ++ flowtable = nf_tables_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME], ++ genmask); ++ if (IS_ERR(flowtable)) ++ return PTR_ERR(flowtable); ++ if (flowtable->use > 0) ++ return -EBUSY; ++ ++ nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla); ++ ++ return nft_delflowtable(&ctx, flowtable); ++} ++ ++static int nf_tables_fill_flowtable_info(struct sk_buff *skb, struct net *net, ++ u32 portid, u32 seq, int event, ++ u32 flags, int family, ++ struct nft_flowtable *flowtable) ++{ ++ struct nlattr *nest, *nest_devs; ++ struct nfgenmsg *nfmsg; ++ struct nlmsghdr *nlh; ++ int i; ++ ++ event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event); ++ nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags); ++ if (nlh == NULL) ++ goto nla_put_failure; ++ ++ nfmsg = nlmsg_data(nlh); ++ nfmsg->nfgen_family = family; ++ nfmsg->version = NFNETLINK_V0; ++ nfmsg->res_id = htons(net->nft.base_seq & 0xffff); ++ ++ if (nla_put_string(skb, NFTA_FLOWTABLE_TABLE, flowtable->table->name) || ++ nla_put_string(skb, NFTA_FLOWTABLE_NAME, flowtable->name) || ++ nla_put_be32(skb, NFTA_FLOWTABLE_USE, htonl(flowtable->use))) ++ goto nla_put_failure; ++ ++ nest = nla_nest_start(skb, NFTA_FLOWTABLE_HOOK); ++ if (nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_NUM, htonl(flowtable->hooknum)) || ++ nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_PRIORITY, htonl(flowtable->priority))) ++ goto nla_put_failure; ++ ++ nest_devs = nla_nest_start(skb, NFTA_FLOWTABLE_HOOK_DEVS); ++ if (!nest_devs) ++ goto nla_put_failure; ++ ++ for (i = 0; i < flowtable->ops_len; i++) { ++ if (flowtable->ops[i].dev && ++ nla_put_string(skb, NFTA_DEVICE_NAME, ++ flowtable->ops[i].dev->name)) ++ goto nla_put_failure; ++ } ++ nla_nest_end(skb, nest_devs); ++ nla_nest_end(skb, nest); ++ ++ nlmsg_end(skb, nlh); ++ return 0; ++ ++nla_put_failure: ++ nlmsg_trim(skb, nlh); ++ return -1; ++} ++ ++struct nft_flowtable_filter { ++ char *table; ++}; ++ ++static int nf_tables_dump_flowtable(struct sk_buff *skb, ++ struct netlink_callback *cb) ++{ ++ const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); ++ struct nft_flowtable_filter *filter = cb->data; ++ unsigned int idx = 0, s_idx = cb->args[0]; ++ struct net *net = sock_net(skb->sk); ++ int family = nfmsg->nfgen_family; ++ struct nft_flowtable *flowtable; ++ const struct nft_af_info *afi; ++ const struct nft_table *table; ++ ++ rcu_read_lock(); ++ cb->seq = net->nft.base_seq; ++ ++ list_for_each_entry_rcu(afi, &net->nft.af_info, list) { ++ if (family != NFPROTO_UNSPEC && family != afi->family) ++ continue; ++ ++ list_for_each_entry_rcu(table, &afi->tables, list) { ++ list_for_each_entry_rcu(flowtable, &table->flowtables, list) { ++ if (!nft_is_active(net, flowtable)) ++ goto cont; ++ if (idx < s_idx) ++ goto cont; ++ if (idx > s_idx) ++ memset(&cb->args[1], 0, ++ sizeof(cb->args) - sizeof(cb->args[0])); ++ if (filter && filter->table[0] && ++ strcmp(filter->table, table->name)) ++ goto cont; ++ ++ if (nf_tables_fill_flowtable_info(skb, net, NETLINK_CB(cb->skb).portid, ++ cb->nlh->nlmsg_seq, ++ NFT_MSG_NEWFLOWTABLE, ++ NLM_F_MULTI | NLM_F_APPEND, ++ afi->family, flowtable) < 0) ++ goto done; ++ ++ nl_dump_check_consistent(cb, nlmsg_hdr(skb)); ++cont: ++ idx++; ++ } ++ } ++ } ++done: ++ rcu_read_unlock(); ++ ++ cb->args[0] = idx; ++ return skb->len; ++} ++ ++static int nf_tables_dump_flowtable_done(struct netlink_callback *cb) ++{ ++ struct nft_flowtable_filter *filter = cb->data; ++ ++ if (!filter) ++ return 0; ++ ++ kfree(filter->table); ++ kfree(filter); ++ ++ return 0; ++} ++ ++static struct nft_flowtable_filter * ++nft_flowtable_filter_alloc(const struct nlattr * const nla[]) ++{ ++ struct nft_flowtable_filter *filter; ++ ++ filter = kzalloc(sizeof(*filter), GFP_KERNEL); ++ if (!filter) ++ return ERR_PTR(-ENOMEM); ++ ++ if (nla[NFTA_FLOWTABLE_TABLE]) { ++ filter->table = nla_strdup(nla[NFTA_FLOWTABLE_TABLE], ++ GFP_KERNEL); ++ if (!filter->table) { ++ kfree(filter); ++ return ERR_PTR(-ENOMEM); ++ } ++ } ++ return filter; ++} ++ ++static int nf_tables_getflowtable(struct net *net, struct sock *nlsk, ++ struct sk_buff *skb, ++ const struct nlmsghdr *nlh, ++ const struct nlattr * const nla[], ++ struct netlink_ext_ack *extack) ++{ ++ const struct nfgenmsg *nfmsg = nlmsg_data(nlh); ++ u8 genmask = nft_genmask_cur(net); ++ int family = nfmsg->nfgen_family; ++ struct nft_flowtable *flowtable; ++ const struct nft_af_info *afi; ++ const struct nft_table *table; ++ struct sk_buff *skb2; ++ int err; ++ ++ if (nlh->nlmsg_flags & NLM_F_DUMP) { ++ struct netlink_dump_control c = { ++ .dump = nf_tables_dump_flowtable, ++ .done = nf_tables_dump_flowtable_done, ++ }; ++ ++ if (nla[NFTA_FLOWTABLE_TABLE]) { ++ struct nft_flowtable_filter *filter; ++ ++ filter = nft_flowtable_filter_alloc(nla); ++ if (IS_ERR(filter)) ++ return -ENOMEM; ++ ++ c.data = filter; ++ } ++ return netlink_dump_start(nlsk, skb, nlh, &c); ++ } ++ ++ if (!nla[NFTA_FLOWTABLE_NAME]) ++ return -EINVAL; ++ ++ afi = nf_tables_afinfo_lookup(net, family, false); ++ if (IS_ERR(afi)) ++ return PTR_ERR(afi); ++ ++ table = nf_tables_table_lookup(afi, nla[NFTA_FLOWTABLE_TABLE], genmask); ++ if (IS_ERR(table)) ++ return PTR_ERR(table); ++ ++ flowtable = nf_tables_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME], ++ genmask); ++ if (IS_ERR(table)) ++ return PTR_ERR(flowtable); ++ ++ skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL); ++ if (!skb2) ++ return -ENOMEM; ++ ++ err = nf_tables_fill_flowtable_info(skb2, net, NETLINK_CB(skb).portid, ++ nlh->nlmsg_seq, ++ NFT_MSG_NEWFLOWTABLE, 0, family, ++ flowtable); ++ if (err < 0) ++ goto err; ++ ++ return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid); ++err: ++ kfree_skb(skb2); ++ return err; ++} ++ ++static void nf_tables_flowtable_notify(struct nft_ctx *ctx, ++ struct nft_flowtable *flowtable, ++ int event) ++{ ++ struct sk_buff *skb; ++ int err; ++ ++ if (ctx->report && ++ !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES)) ++ return; ++ ++ skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); ++ if (skb == NULL) ++ goto err; ++ ++ err = nf_tables_fill_flowtable_info(skb, ctx->net, ctx->portid, ++ ctx->seq, event, 0, ++ ctx->afi->family, flowtable); ++ if (err < 0) { ++ kfree_skb(skb); ++ goto err; ++ } ++ ++ nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES, ++ ctx->report, GFP_KERNEL); ++ return; ++err: ++ nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS); ++} ++ ++static void nft_flowtable_destroy(void *ptr, void *arg) ++{ ++ kfree(ptr); ++} ++ ++static void nf_tables_flowtable_destroy(struct nft_flowtable *flowtable) ++{ ++ cancel_delayed_work_sync(&flowtable->data.gc_work); ++ kfree(flowtable->name); ++ rhashtable_free_and_destroy(&flowtable->data.rhashtable, ++ nft_flowtable_destroy, NULL); ++ module_put(flowtable->data.type->owner); ++} ++ + static int nf_tables_fill_gen_info(struct sk_buff *skb, struct net *net, + u32 portid, u32 seq) + { +@@ -4865,6 +5508,49 @@ nla_put_failure: + return -EMSGSIZE; + } + ++static void nft_flowtable_event(unsigned long event, struct net_device *dev, ++ struct nft_flowtable *flowtable) ++{ ++ int i; ++ ++ for (i = 0; i < flowtable->ops_len; i++) { ++ if (flowtable->ops[i].dev != dev) ++ continue; ++ ++ nf_unregister_net_hook(dev_net(dev), &flowtable->ops[i]); ++ flowtable->ops[i].dev = NULL; ++ break; ++ } ++} ++ ++static int nf_tables_flowtable_event(struct notifier_block *this, ++ unsigned long event, void *ptr) ++{ ++ struct net_device *dev = netdev_notifier_info_to_dev(ptr); ++ struct nft_flowtable *flowtable; ++ struct nft_table *table; ++ struct nft_af_info *afi; ++ ++ if (event != NETDEV_UNREGISTER) ++ return 0; ++ ++ nfnl_lock(NFNL_SUBSYS_NFTABLES); ++ list_for_each_entry(afi, &dev_net(dev)->nft.af_info, list) { ++ list_for_each_entry(table, &afi->tables, list) { ++ list_for_each_entry(flowtable, &table->flowtables, list) { ++ nft_flowtable_event(event, dev, flowtable); ++ } ++ } ++ } ++ nfnl_unlock(NFNL_SUBSYS_NFTABLES); ++ ++ return NOTIFY_DONE; ++} ++ ++static struct notifier_block nf_tables_flowtable_notifier = { ++ .notifier_call = nf_tables_flowtable_event, ++}; ++ + static void nf_tables_gen_notify(struct net *net, struct sk_buff *skb, + int event) + { +@@ -5017,6 +5703,21 @@ static const struct nfnl_callback nf_tab + .attr_count = NFTA_OBJ_MAX, + .policy = nft_obj_policy, + }, ++ [NFT_MSG_NEWFLOWTABLE] = { ++ .call_batch = nf_tables_newflowtable, ++ .attr_count = NFTA_FLOWTABLE_MAX, ++ .policy = nft_flowtable_policy, ++ }, ++ [NFT_MSG_GETFLOWTABLE] = { ++ .call = nf_tables_getflowtable, ++ .attr_count = NFTA_FLOWTABLE_MAX, ++ .policy = nft_flowtable_policy, ++ }, ++ [NFT_MSG_DELFLOWTABLE] = { ++ .call_batch = nf_tables_delflowtable, ++ .attr_count = NFTA_FLOWTABLE_MAX, ++ .policy = nft_flowtable_policy, ++ }, + }; + + static void nft_chain_commit_update(struct nft_trans *trans) +@@ -5065,6 +5766,9 @@ static void nf_tables_commit_release(str + case NFT_MSG_DELOBJ: + nft_obj_destroy(nft_trans_obj(trans)); + break; ++ case NFT_MSG_DELFLOWTABLE: ++ nf_tables_flowtable_destroy(nft_trans_flowtable(trans)); ++ break; + } + kfree(trans); + } +@@ -5184,6 +5888,21 @@ static int nf_tables_commit(struct net * + nf_tables_obj_notify(&trans->ctx, nft_trans_obj(trans), + NFT_MSG_DELOBJ); + break; ++ case NFT_MSG_NEWFLOWTABLE: ++ nft_clear(net, nft_trans_flowtable(trans)); ++ nf_tables_flowtable_notify(&trans->ctx, ++ nft_trans_flowtable(trans), ++ NFT_MSG_NEWFLOWTABLE); ++ nft_trans_destroy(trans); ++ break; ++ case NFT_MSG_DELFLOWTABLE: ++ list_del_rcu(&nft_trans_flowtable(trans)->list); ++ nf_tables_flowtable_notify(&trans->ctx, ++ nft_trans_flowtable(trans), ++ NFT_MSG_DELFLOWTABLE); ++ nft_unregister_flowtable_net_hooks(net, ++ nft_trans_flowtable(trans)); ++ break; + } + } + +@@ -5221,6 +5940,9 @@ static void nf_tables_abort_release(stru + case NFT_MSG_NEWOBJ: + nft_obj_destroy(nft_trans_obj(trans)); + break; ++ case NFT_MSG_NEWFLOWTABLE: ++ nf_tables_flowtable_destroy(nft_trans_flowtable(trans)); ++ break; + } + kfree(trans); + } +@@ -5312,6 +6034,17 @@ static int nf_tables_abort(struct net *n + nft_clear(trans->ctx.net, nft_trans_obj(trans)); + nft_trans_destroy(trans); + break; ++ case NFT_MSG_NEWFLOWTABLE: ++ trans->ctx.table->use--; ++ list_del_rcu(&nft_trans_flowtable(trans)->list); ++ nft_unregister_flowtable_net_hooks(net, ++ nft_trans_flowtable(trans)); ++ break; ++ case NFT_MSG_DELFLOWTABLE: ++ trans->ctx.table->use++; ++ nft_clear(trans->ctx.net, nft_trans_flowtable(trans)); ++ nft_trans_destroy(trans); ++ break; + } + } + +@@ -5862,6 +6595,7 @@ EXPORT_SYMBOL_GPL(__nft_release_basechai + /* Called by nft_unregister_afinfo() from __net_exit path, nfnl_lock is held. */ + static void __nft_release_afinfo(struct net *net, struct nft_af_info *afi) + { ++ struct nft_flowtable *flowtable, *nf; + struct nft_table *table, *nt; + struct nft_chain *chain, *nc; + struct nft_object *obj, *ne; +@@ -5875,6 +6609,9 @@ static void __nft_release_afinfo(struct + list_for_each_entry_safe(table, nt, &afi->tables, list) { + list_for_each_entry(chain, &table->chains, list) + nf_tables_unregister_hook(net, table, chain); ++ list_for_each_entry(flowtable, &table->flowtables, list) ++ nf_unregister_net_hooks(net, flowtable->ops, ++ flowtable->ops_len); + /* No packets are walking on these chains anymore. */ + ctx.table = table; + list_for_each_entry(chain, &table->chains, list) { +@@ -5885,6 +6622,11 @@ static void __nft_release_afinfo(struct + nf_tables_rule_release(&ctx, rule); + } + } ++ list_for_each_entry_safe(flowtable, nf, &table->flowtables, list) { ++ list_del(&flowtable->list); ++ table->use--; ++ nf_tables_flowtable_destroy(flowtable); ++ } + list_for_each_entry_safe(set, ns, &table->sets, list) { + list_del(&set->list); + table->use--; +@@ -5928,6 +6670,8 @@ static int __init nf_tables_module_init( + if (err < 0) + goto err3; + ++ register_netdevice_notifier(&nf_tables_flowtable_notifier); ++ + pr_info("nf_tables: (c) 2007-2009 Patrick McHardy <kaber@trash.net>\n"); + return register_pernet_subsys(&nf_tables_net_ops); + err3: +@@ -5942,6 +6686,7 @@ static void __exit nf_tables_module_exit + { + unregister_pernet_subsys(&nf_tables_net_ops); + nfnetlink_subsys_unregister(&nf_tables_subsys); ++ unregister_netdevice_notifier(&nf_tables_flowtable_notifier); + rcu_barrier(); + nf_tables_core_module_exit(); + kfree(info); diff --git a/target/linux/generic/backport-4.19/322-v4.16-netfilter-add-generic-flow-table-infrastructure.patch b/target/linux/generic/backport-4.19/322-v4.16-netfilter-add-generic-flow-table-infrastructure.patch new file mode 100644 index 0000000000..16de9571a8 --- /dev/null +++ b/target/linux/generic/backport-4.19/322-v4.16-netfilter-add-generic-flow-table-infrastructure.patch @@ -0,0 +1,586 @@ +From: Pablo Neira Ayuso <pablo@netfilter.org> +Date: Sun, 7 Jan 2018 01:04:11 +0100 +Subject: [PATCH] netfilter: add generic flow table infrastructure + +This patch defines the API to interact with flow tables, this allows to +add, delete and lookup for entries in the flow table. This also adds the +generic garbage code that removes entries that have expired, ie. no +traffic has been seen for a while. + +Users of the flow table infrastructure can delete entries via +flow_offload_dead(), which sets the dying bit, this signals the garbage +collector to release an entry from user context. + +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + create mode 100644 net/netfilter/nf_flow_table.c + +--- a/include/net/netfilter/nf_flow_table.h ++++ b/include/net/netfilter/nf_flow_table.h +@@ -1,7 +1,12 @@ + #ifndef _NF_FLOW_TABLE_H + #define _NF_FLOW_TABLE_H + ++#include <linux/in.h> ++#include <linux/in6.h> ++#include <linux/netdevice.h> + #include <linux/rhashtable.h> ++#include <linux/rcupdate.h> ++#include <net/dst.h> + + struct nf_flowtable; + +@@ -20,4 +25,93 @@ struct nf_flowtable { + struct delayed_work gc_work; + }; + ++enum flow_offload_tuple_dir { ++ FLOW_OFFLOAD_DIR_ORIGINAL, ++ FLOW_OFFLOAD_DIR_REPLY, ++ __FLOW_OFFLOAD_DIR_MAX = FLOW_OFFLOAD_DIR_REPLY, ++}; ++#define FLOW_OFFLOAD_DIR_MAX (__FLOW_OFFLOAD_DIR_MAX + 1) ++ ++struct flow_offload_tuple { ++ union { ++ struct in_addr src_v4; ++ struct in6_addr src_v6; ++ }; ++ union { ++ struct in_addr dst_v4; ++ struct in6_addr dst_v6; ++ }; ++ struct { ++ __be16 src_port; ++ __be16 dst_port; ++ }; ++ ++ int iifidx; ++ ++ u8 l3proto; ++ u8 l4proto; ++ u8 dir; ++ ++ int oifidx; ++ ++ struct dst_entry *dst_cache; ++}; ++ ++struct flow_offload_tuple_rhash { ++ struct rhash_head node; ++ struct flow_offload_tuple tuple; ++}; ++ ++#define FLOW_OFFLOAD_SNAT 0x1 ++#define FLOW_OFFLOAD_DNAT 0x2 ++#define FLOW_OFFLOAD_DYING 0x4 ++ ++struct flow_offload { ++ struct flow_offload_tuple_rhash tuplehash[FLOW_OFFLOAD_DIR_MAX]; ++ u32 flags; ++ union { ++ /* Your private driver data here. */ ++ u32 timeout; ++ }; ++}; ++ ++#define NF_FLOW_TIMEOUT (30 * HZ) ++ ++struct nf_flow_route { ++ struct { ++ struct dst_entry *dst; ++ int ifindex; ++ } tuple[FLOW_OFFLOAD_DIR_MAX]; ++}; ++ ++struct flow_offload *flow_offload_alloc(struct nf_conn *ct, ++ struct nf_flow_route *route); ++void flow_offload_free(struct flow_offload *flow); ++ ++int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow); ++void flow_offload_del(struct nf_flowtable *flow_table, struct flow_offload *flow); ++struct flow_offload_tuple_rhash *flow_offload_lookup(struct nf_flowtable *flow_table, ++ struct flow_offload_tuple *tuple); ++int nf_flow_table_iterate(struct nf_flowtable *flow_table, ++ void (*iter)(struct flow_offload *flow, void *data), ++ void *data); ++void nf_flow_offload_work_gc(struct work_struct *work); ++extern const struct rhashtable_params nf_flow_offload_rhash_params; ++ ++void flow_offload_dead(struct flow_offload *flow); ++ ++int nf_flow_snat_port(const struct flow_offload *flow, ++ struct sk_buff *skb, unsigned int thoff, ++ u8 protocol, enum flow_offload_tuple_dir dir); ++int nf_flow_dnat_port(const struct flow_offload *flow, ++ struct sk_buff *skb, unsigned int thoff, ++ u8 protocol, enum flow_offload_tuple_dir dir); ++ ++struct flow_ports { ++ __be16 source, dest; ++}; ++ ++#define MODULE_ALIAS_NF_FLOWTABLE(family) \ ++ MODULE_ALIAS("nf-flowtable-" __stringify(family)) ++ + #endif /* _FLOW_OFFLOAD_H */ +--- a/net/netfilter/Kconfig ++++ b/net/netfilter/Kconfig +@@ -667,6 +667,13 @@ endif # NF_TABLES_NETDEV + + endif # NF_TABLES + ++config NF_FLOW_TABLE ++ tristate "Netfilter flow table module" ++ help ++ This option adds the flow table core infrastructure. ++ ++ To compile it as a module, choose M here. ++ + config NETFILTER_XTABLES + tristate "Netfilter Xtables support (required for ip_tables)" + default m if NETFILTER_ADVANCED=n +--- a/net/netfilter/Makefile ++++ b/net/netfilter/Makefile +@@ -110,6 +110,9 @@ obj-$(CONFIG_NFT_FIB_NETDEV) += nft_fib_ + obj-$(CONFIG_NFT_DUP_NETDEV) += nft_dup_netdev.o + obj-$(CONFIG_NFT_FWD_NETDEV) += nft_fwd_netdev.o + ++# flow table infrastructure ++obj-$(CONFIG_NF_FLOW_TABLE) += nf_flow_table.o ++ + # generic X tables + obj-$(CONFIG_NETFILTER_XTABLES) += x_tables.o xt_tcpudp.o + +--- /dev/null ++++ b/net/netfilter/nf_flow_table.c +@@ -0,0 +1,429 @@ ++#include <linux/kernel.h> ++#include <linux/init.h> ++#include <linux/module.h> ++#include <linux/netfilter.h> ++#include <linux/rhashtable.h> ++#include <linux/netdevice.h> ++#include <net/netfilter/nf_flow_table.h> ++#include <net/netfilter/nf_conntrack.h> ++#include <net/netfilter/nf_conntrack_core.h> ++#include <net/netfilter/nf_conntrack_tuple.h> ++ ++struct flow_offload_entry { ++ struct flow_offload flow; ++ struct nf_conn *ct; ++ struct rcu_head rcu_head; ++}; ++ ++struct flow_offload * ++flow_offload_alloc(struct nf_conn *ct, struct nf_flow_route *route) ++{ ++ struct flow_offload_entry *entry; ++ struct flow_offload *flow; ++ ++ if (unlikely(nf_ct_is_dying(ct) || ++ !atomic_inc_not_zero(&ct->ct_general.use))) ++ return NULL; ++ ++ entry = kzalloc(sizeof(*entry), GFP_ATOMIC); ++ if (!entry) ++ goto err_ct_refcnt; ++ ++ flow = &entry->flow; ++ ++ if (!dst_hold_safe(route->tuple[FLOW_OFFLOAD_DIR_ORIGINAL].dst)) ++ goto err_dst_cache_original; ++ ++ if (!dst_hold_safe(route->tuple[FLOW_OFFLOAD_DIR_REPLY].dst)) ++ goto err_dst_cache_reply; ++ ++ entry->ct = ct; ++ ++ switch (ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num) { ++ case NFPROTO_IPV4: ++ flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_v4 = ++ ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3.in; ++ flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_v4 = ++ ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u3.in; ++ flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_v4 = ++ ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3.in; ++ flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_v4 = ++ ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3.in; ++ break; ++ case NFPROTO_IPV6: ++ flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_v6 = ++ ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3.in6; ++ flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_v6 = ++ ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u3.in6; ++ flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_v6 = ++ ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3.in6; ++ flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_v6 = ++ ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3.in6; ++ break; ++ } ++ ++ flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.l3proto = ++ ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num; ++ flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.l4proto = ++ ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum; ++ flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.l3proto = ++ ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num; ++ flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.l4proto = ++ ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum; ++ ++ flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_cache = ++ route->tuple[FLOW_OFFLOAD_DIR_ORIGINAL].dst; ++ flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_cache = ++ route->tuple[FLOW_OFFLOAD_DIR_REPLY].dst; ++ ++ flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_port = ++ ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u.tcp.port; ++ flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_port = ++ ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u.tcp.port; ++ flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_port = ++ ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u.tcp.port; ++ flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_port = ++ ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u.tcp.port; ++ ++ flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dir = ++ FLOW_OFFLOAD_DIR_ORIGINAL; ++ flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dir = ++ FLOW_OFFLOAD_DIR_REPLY; ++ ++ flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.iifidx = ++ route->tuple[FLOW_OFFLOAD_DIR_ORIGINAL].ifindex; ++ flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.oifidx = ++ route->tuple[FLOW_OFFLOAD_DIR_REPLY].ifindex; ++ flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.iifidx = ++ route->tuple[FLOW_OFFLOAD_DIR_REPLY].ifindex; ++ flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.oifidx = ++ route->tuple[FLOW_OFFLOAD_DIR_ORIGINAL].ifindex; ++ ++ if (ct->status & IPS_SRC_NAT) ++ flow->flags |= FLOW_OFFLOAD_SNAT; ++ else if (ct->status & IPS_DST_NAT) ++ flow->flags |= FLOW_OFFLOAD_DNAT; ++ ++ return flow; ++ ++err_dst_cache_reply: ++ dst_release(route->tuple[FLOW_OFFLOAD_DIR_ORIGINAL].dst); ++err_dst_cache_original: ++ kfree(entry); ++err_ct_refcnt: ++ nf_ct_put(ct); ++ ++ return NULL; ++} ++EXPORT_SYMBOL_GPL(flow_offload_alloc); ++ ++void flow_offload_free(struct flow_offload *flow) ++{ ++ struct flow_offload_entry *e; ++ ++ dst_release(flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_cache); ++ dst_release(flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_cache); ++ e = container_of(flow, struct flow_offload_entry, flow); ++ kfree(e); ++} ++EXPORT_SYMBOL_GPL(flow_offload_free); ++ ++void flow_offload_dead(struct flow_offload *flow) ++{ ++ flow->flags |= FLOW_OFFLOAD_DYING; ++} ++EXPORT_SYMBOL_GPL(flow_offload_dead); ++ ++int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow) ++{ ++ flow->timeout = (u32)jiffies; ++ ++ rhashtable_insert_fast(&flow_table->rhashtable, ++ &flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].node, ++ *flow_table->type->params); ++ rhashtable_insert_fast(&flow_table->rhashtable, ++ &flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].node, ++ *flow_table->type->params); ++ return 0; ++} ++EXPORT_SYMBOL_GPL(flow_offload_add); ++ ++void flow_offload_del(struct nf_flowtable *flow_table, ++ struct flow_offload *flow) ++{ ++ struct flow_offload_entry *e; ++ ++ rhashtable_remove_fast(&flow_table->rhashtable, ++ &flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].node, ++ *flow_table->type->params); ++ rhashtable_remove_fast(&flow_table->rhashtable, ++ &flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].node, ++ *flow_table->type->params); ++ ++ e = container_of(flow, struct flow_offload_entry, flow); ++ kfree_rcu(e, rcu_head); ++} ++EXPORT_SYMBOL_GPL(flow_offload_del); ++ ++struct flow_offload_tuple_rhash * ++flow_offload_lookup(struct nf_flowtable *flow_table, ++ struct flow_offload_tuple *tuple) ++{ ++ return rhashtable_lookup_fast(&flow_table->rhashtable, tuple, ++ *flow_table->type->params); ++} ++EXPORT_SYMBOL_GPL(flow_offload_lookup); ++ ++static void nf_flow_release_ct(const struct flow_offload *flow) ++{ ++ struct flow_offload_entry *e; ++ ++ e = container_of(flow, struct flow_offload_entry, flow); ++ nf_ct_delete(e->ct, 0, 0); ++ nf_ct_put(e->ct); ++} ++ ++int nf_flow_table_iterate(struct nf_flowtable *flow_table, ++ void (*iter)(struct flow_offload *flow, void *data), ++ void *data) ++{ ++ struct flow_offload_tuple_rhash *tuplehash; ++ struct rhashtable_iter hti; ++ struct flow_offload *flow; ++ int err; ++ ++ err = rhashtable_walk_init(&flow_table->rhashtable, &hti, GFP_KERNEL); ++ if (err) ++ return err; ++ ++ rhashtable_walk_start(&hti); ++ ++ while ((tuplehash = rhashtable_walk_next(&hti))) { ++ if (IS_ERR(tuplehash)) { ++ err = PTR_ERR(tuplehash); ++ if (err != -EAGAIN) ++ goto out; ++ ++ continue; ++ } ++ if (tuplehash->tuple.dir) ++ continue; ++ ++ flow = container_of(tuplehash, struct flow_offload, tuplehash[0]); ++ ++ iter(flow, data); ++ } ++out: ++ rhashtable_walk_stop(&hti); ++ rhashtable_walk_exit(&hti); ++ ++ return err; ++} ++EXPORT_SYMBOL_GPL(nf_flow_table_iterate); ++ ++static inline bool nf_flow_has_expired(const struct flow_offload *flow) ++{ ++ return (__s32)(flow->timeout - (u32)jiffies) <= 0; ++} ++ ++static inline bool nf_flow_is_dying(const struct flow_offload *flow) ++{ ++ return flow->flags & FLOW_OFFLOAD_DYING; ++} ++ ++void nf_flow_offload_work_gc(struct work_struct *work) ++{ ++ struct flow_offload_tuple_rhash *tuplehash; ++ struct nf_flowtable *flow_table; ++ struct rhashtable_iter hti; ++ struct flow_offload *flow; ++ int err; ++ ++ flow_table = container_of(work, struct nf_flowtable, gc_work.work); ++ ++ err = rhashtable_walk_init(&flow_table->rhashtable, &hti, GFP_KERNEL); ++ if (err) ++ goto schedule; ++ ++ rhashtable_walk_start(&hti); ++ ++ while ((tuplehash = rhashtable_walk_next(&hti))) { ++ if (IS_ERR(tuplehash)) { ++ err = PTR_ERR(tuplehash); ++ if (err != -EAGAIN) ++ goto out; ++ ++ continue; ++ } ++ if (tuplehash->tuple.dir) ++ continue; ++ ++ flow = container_of(tuplehash, struct flow_offload, tuplehash[0]); ++ ++ if (nf_flow_has_expired(flow) || ++ nf_flow_is_dying(flow)) { ++ flow_offload_del(flow_table, flow); ++ nf_flow_release_ct(flow); ++ } ++ } ++out: ++ rhashtable_walk_stop(&hti); ++ rhashtable_walk_exit(&hti); ++schedule: ++ queue_delayed_work(system_power_efficient_wq, &flow_table->gc_work, HZ); ++} ++EXPORT_SYMBOL_GPL(nf_flow_offload_work_gc); ++ ++static u32 flow_offload_hash(const void *data, u32 len, u32 seed) ++{ ++ const struct flow_offload_tuple *tuple = data; ++ ++ return jhash(tuple, offsetof(struct flow_offload_tuple, dir), seed); ++} ++ ++static u32 flow_offload_hash_obj(const void *data, u32 len, u32 seed) ++{ ++ const struct flow_offload_tuple_rhash *tuplehash = data; ++ ++ return jhash(&tuplehash->tuple, offsetof(struct flow_offload_tuple, dir), seed); ++} ++ ++static int flow_offload_hash_cmp(struct rhashtable_compare_arg *arg, ++ const void *ptr) ++{ ++ const struct flow_offload_tuple *tuple = arg->key; ++ const struct flow_offload_tuple_rhash *x = ptr; ++ ++ if (memcmp(&x->tuple, tuple, offsetof(struct flow_offload_tuple, dir))) ++ return 1; ++ ++ return 0; ++} ++ ++const struct rhashtable_params nf_flow_offload_rhash_params = { ++ .head_offset = offsetof(struct flow_offload_tuple_rhash, node), ++ .hashfn = flow_offload_hash, ++ .obj_hashfn = flow_offload_hash_obj, ++ .obj_cmpfn = flow_offload_hash_cmp, ++ .automatic_shrinking = true, ++}; ++EXPORT_SYMBOL_GPL(nf_flow_offload_rhash_params); ++ ++static int nf_flow_nat_port_tcp(struct sk_buff *skb, unsigned int thoff, ++ __be16 port, __be16 new_port) ++{ ++ struct tcphdr *tcph; ++ ++ if (!pskb_may_pull(skb, thoff + sizeof(*tcph)) || ++ skb_try_make_writable(skb, thoff + sizeof(*tcph))) ++ return -1; ++ ++ tcph = (void *)(skb_network_header(skb) + thoff); ++ inet_proto_csum_replace2(&tcph->check, skb, port, new_port, true); ++ ++ return 0; ++} ++ ++static int nf_flow_nat_port_udp(struct sk_buff *skb, unsigned int thoff, ++ __be16 port, __be16 new_port) ++{ ++ struct udphdr *udph; ++ ++ if (!pskb_may_pull(skb, thoff + sizeof(*udph)) || ++ skb_try_make_writable(skb, thoff + sizeof(*udph))) ++ return -1; ++ ++ udph = (void *)(skb_network_header(skb) + thoff); ++ if (udph->check || skb->ip_summed == CHECKSUM_PARTIAL) { ++ inet_proto_csum_replace2(&udph->check, skb, port, ++ new_port, true); ++ if (!udph->check) ++ udph->check = CSUM_MANGLED_0; ++ } ++ ++ return 0; ++} ++ ++static int nf_flow_nat_port(struct sk_buff *skb, unsigned int thoff, ++ u8 protocol, __be16 port, __be16 new_port) ++{ ++ switch (protocol) { ++ case IPPROTO_TCP: ++ if (nf_flow_nat_port_tcp(skb, thoff, port, new_port) < 0) ++ return NF_DROP; ++ break; ++ case IPPROTO_UDP: ++ if (nf_flow_nat_port_udp(skb, thoff, port, new_port) < 0) ++ return NF_DROP; ++ break; ++ } ++ ++ return 0; ++} ++ ++int nf_flow_snat_port(const struct flow_offload *flow, ++ struct sk_buff *skb, unsigned int thoff, ++ u8 protocol, enum flow_offload_tuple_dir dir) ++{ ++ struct flow_ports *hdr; ++ __be16 port, new_port; ++ ++ if (!pskb_may_pull(skb, thoff + sizeof(*hdr)) || ++ skb_try_make_writable(skb, thoff + sizeof(*hdr))) ++ return -1; ++ ++ hdr = (void *)(skb_network_header(skb) + thoff); ++ ++ switch (dir) { ++ case FLOW_OFFLOAD_DIR_ORIGINAL: ++ port = hdr->source; ++ new_port = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_port; ++ hdr->source = new_port; ++ break; ++ case FLOW_OFFLOAD_DIR_REPLY: ++ port = hdr->dest; ++ new_port = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_port; ++ hdr->dest = new_port; ++ break; ++ default: ++ return -1; ++ } ++ ++ return nf_flow_nat_port(skb, thoff, protocol, port, new_port); ++} ++EXPORT_SYMBOL_GPL(nf_flow_snat_port); ++ ++int nf_flow_dnat_port(const struct flow_offload *flow, ++ struct sk_buff *skb, unsigned int thoff, ++ u8 protocol, enum flow_offload_tuple_dir dir) ++{ ++ struct flow_ports *hdr; ++ __be16 port, new_port; ++ ++ if (!pskb_may_pull(skb, thoff + sizeof(*hdr)) || ++ skb_try_make_writable(skb, thoff + sizeof(*hdr))) ++ return -1; ++ ++ hdr = (void *)(skb_network_header(skb) + thoff); ++ ++ switch (dir) { ++ case FLOW_OFFLOAD_DIR_ORIGINAL: ++ port = hdr->dest; ++ new_port = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_port; ++ hdr->dest = new_port; ++ break; ++ case FLOW_OFFLOAD_DIR_REPLY: ++ port = hdr->source; ++ new_port = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_port; ++ hdr->source = new_port; ++ break; ++ default: ++ return -1; ++ } ++ ++ return nf_flow_nat_port(skb, thoff, protocol, port, new_port); ++} ++EXPORT_SYMBOL_GPL(nf_flow_dnat_port); ++ ++MODULE_LICENSE("GPL"); ++MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>"); diff --git a/target/linux/generic/backport-4.19/323-v4.16-netfilter-flow-table-support-for-IPv4.patch b/target/linux/generic/backport-4.19/323-v4.16-netfilter-flow-table-support-for-IPv4.patch new file mode 100644 index 0000000000..50d9039c12 --- /dev/null +++ b/target/linux/generic/backport-4.19/323-v4.16-netfilter-flow-table-support-for-IPv4.patch @@ -0,0 +1,334 @@ +From: Pablo Neira Ayuso <pablo@netfilter.org> +Date: Sun, 7 Jan 2018 01:04:15 +0100 +Subject: [PATCH] netfilter: flow table support for IPv4 + +This patch adds the IPv4 flow table type, that implements the datapath +flow table to forward IPv4 traffic. Rationale is: + +1) Look up for the packet in the flow table, from the ingress hook. +2) If there's a hit, decrement ttl and pass it on to the neighbour layer + for transmission. +3) If there's a miss, packet is passed up to the classic forwarding + path. + +This patch also supports layer 3 source and destination NAT. + +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + create mode 100644 net/ipv4/netfilter/nf_flow_table_ipv4.c + +--- a/net/ipv4/netfilter/Kconfig ++++ b/net/ipv4/netfilter/Kconfig +@@ -78,6 +78,14 @@ config NF_TABLES_ARP + + endif # NF_TABLES + ++config NF_FLOW_TABLE_IPV4 ++ select NF_FLOW_TABLE ++ tristate "Netfilter flow table IPv4 module" ++ help ++ This option adds the flow table IPv4 support. ++ ++ To compile it as a module, choose M here. ++ + config NF_DUP_IPV4 + tristate "Netfilter IPv4 packet duplication to alternate destination" + depends on !NF_CONNTRACK || NF_CONNTRACK +--- a/net/ipv4/netfilter/Makefile ++++ b/net/ipv4/netfilter/Makefile +@@ -43,6 +43,9 @@ obj-$(CONFIG_NFT_REDIR_IPV4) += nft_redi + obj-$(CONFIG_NFT_DUP_IPV4) += nft_dup_ipv4.o + obj-$(CONFIG_NF_TABLES_ARP) += nf_tables_arp.o + ++# flow table support ++obj-$(CONFIG_NF_FLOW_TABLE_IPV4) += nf_flow_table_ipv4.o ++ + # generic IP tables + obj-$(CONFIG_IP_NF_IPTABLES) += ip_tables.o + +--- /dev/null ++++ b/net/ipv4/netfilter/nf_flow_table_ipv4.c +@@ -0,0 +1,283 @@ ++#include <linux/kernel.h> ++#include <linux/init.h> ++#include <linux/module.h> ++#include <linux/netfilter.h> ++#include <linux/rhashtable.h> ++#include <linux/ip.h> ++#include <linux/netdevice.h> ++#include <net/ip.h> ++#include <net/neighbour.h> ++#include <net/netfilter/nf_flow_table.h> ++#include <net/netfilter/nf_tables.h> ++/* For layer 4 checksum field offset. */ ++#include <linux/tcp.h> ++#include <linux/udp.h> ++ ++static int nf_flow_nat_ip_tcp(struct sk_buff *skb, unsigned int thoff, ++ __be32 addr, __be32 new_addr) ++{ ++ struct tcphdr *tcph; ++ ++ if (!pskb_may_pull(skb, thoff + sizeof(*tcph)) || ++ skb_try_make_writable(skb, thoff + sizeof(*tcph))) ++ return -1; ++ ++ tcph = (void *)(skb_network_header(skb) + thoff); ++ inet_proto_csum_replace4(&tcph->check, skb, addr, new_addr, true); ++ ++ return 0; ++} ++ ++static int nf_flow_nat_ip_udp(struct sk_buff *skb, unsigned int thoff, ++ __be32 addr, __be32 new_addr) ++{ ++ struct udphdr *udph; ++ ++ if (!pskb_may_pull(skb, thoff + sizeof(*udph)) || ++ skb_try_make_writable(skb, thoff + sizeof(*udph))) ++ return -1; ++ ++ udph = (void *)(skb_network_header(skb) + thoff); ++ if (udph->check || skb->ip_summed == CHECKSUM_PARTIAL) { ++ inet_proto_csum_replace4(&udph->check, skb, addr, ++ new_addr, true); ++ if (!udph->check) ++ udph->check = CSUM_MANGLED_0; ++ } ++ ++ return 0; ++} ++ ++static int nf_flow_nat_ip_l4proto(struct sk_buff *skb, struct iphdr *iph, ++ unsigned int thoff, __be32 addr, ++ __be32 new_addr) ++{ ++ switch (iph->protocol) { ++ case IPPROTO_TCP: ++ if (nf_flow_nat_ip_tcp(skb, thoff, addr, new_addr) < 0) ++ return NF_DROP; ++ break; ++ case IPPROTO_UDP: ++ if (nf_flow_nat_ip_udp(skb, thoff, addr, new_addr) < 0) ++ return NF_DROP; ++ break; ++ } ++ ++ return 0; ++} ++ ++static int nf_flow_snat_ip(const struct flow_offload *flow, struct sk_buff *skb, ++ struct iphdr *iph, unsigned int thoff, ++ enum flow_offload_tuple_dir dir) ++{ ++ __be32 addr, new_addr; ++ ++ switch (dir) { ++ case FLOW_OFFLOAD_DIR_ORIGINAL: ++ addr = iph->saddr; ++ new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_v4.s_addr; ++ iph->saddr = new_addr; ++ break; ++ case FLOW_OFFLOAD_DIR_REPLY: ++ addr = iph->daddr; ++ new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_v4.s_addr; ++ iph->daddr = new_addr; ++ break; ++ default: ++ return -1; ++ } ++ csum_replace4(&iph->check, addr, new_addr); ++ ++ return nf_flow_nat_ip_l4proto(skb, iph, thoff, addr, new_addr); ++} ++ ++static int nf_flow_dnat_ip(const struct flow_offload *flow, struct sk_buff *skb, ++ struct iphdr *iph, unsigned int thoff, ++ enum flow_offload_tuple_dir dir) ++{ ++ __be32 addr, new_addr; ++ ++ switch (dir) { ++ case FLOW_OFFLOAD_DIR_ORIGINAL: ++ addr = iph->daddr; ++ new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_v4.s_addr; ++ iph->daddr = new_addr; ++ break; ++ case FLOW_OFFLOAD_DIR_REPLY: ++ addr = iph->saddr; ++ new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_v4.s_addr; ++ iph->saddr = new_addr; ++ break; ++ default: ++ return -1; ++ } ++ ++ return nf_flow_nat_ip_l4proto(skb, iph, thoff, addr, new_addr); ++} ++ ++static int nf_flow_nat_ip(const struct flow_offload *flow, struct sk_buff *skb, ++ enum flow_offload_tuple_dir dir) ++{ ++ struct iphdr *iph = ip_hdr(skb); ++ unsigned int thoff = iph->ihl * 4; ++ ++ if (flow->flags & FLOW_OFFLOAD_SNAT && ++ (nf_flow_snat_port(flow, skb, thoff, iph->protocol, dir) < 0 || ++ nf_flow_snat_ip(flow, skb, iph, thoff, dir) < 0)) ++ return -1; ++ if (flow->flags & FLOW_OFFLOAD_DNAT && ++ (nf_flow_dnat_port(flow, skb, thoff, iph->protocol, dir) < 0 || ++ nf_flow_dnat_ip(flow, skb, iph, thoff, dir) < 0)) ++ return -1; ++ ++ return 0; ++} ++ ++static bool ip_has_options(unsigned int thoff) ++{ ++ return thoff != sizeof(struct iphdr); ++} ++ ++static int nf_flow_tuple_ip(struct sk_buff *skb, const struct net_device *dev, ++ struct flow_offload_tuple *tuple) ++{ ++ struct flow_ports *ports; ++ unsigned int thoff; ++ struct iphdr *iph; ++ ++ if (!pskb_may_pull(skb, sizeof(*iph))) ++ return -1; ++ ++ iph = ip_hdr(skb); ++ thoff = iph->ihl * 4; ++ ++ if (ip_is_fragment(iph) || ++ unlikely(ip_has_options(thoff))) ++ return -1; ++ ++ if (iph->protocol != IPPROTO_TCP && ++ iph->protocol != IPPROTO_UDP) ++ return -1; ++ ++ thoff = iph->ihl * 4; ++ if (!pskb_may_pull(skb, thoff + sizeof(*ports))) ++ return -1; ++ ++ ports = (struct flow_ports *)(skb_network_header(skb) + thoff); ++ ++ tuple->src_v4.s_addr = iph->saddr; ++ tuple->dst_v4.s_addr = iph->daddr; ++ tuple->src_port = ports->source; ++ tuple->dst_port = ports->dest; ++ tuple->l3proto = AF_INET; ++ tuple->l4proto = iph->protocol; ++ tuple->iifidx = dev->ifindex; ++ ++ return 0; ++} ++ ++/* Based on ip_exceeds_mtu(). */ ++static bool __nf_flow_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu) ++{ ++ if (skb->len <= mtu) ++ return false; ++ ++ if ((ip_hdr(skb)->frag_off & htons(IP_DF)) == 0) ++ return false; ++ ++ if (skb_is_gso(skb) && skb_gso_validate_mtu(skb, mtu)) ++ return false; ++ ++ return true; ++} ++ ++static bool nf_flow_exceeds_mtu(struct sk_buff *skb, const struct rtable *rt) ++{ ++ u32 mtu; ++ ++ mtu = ip_dst_mtu_maybe_forward(&rt->dst, true); ++ if (__nf_flow_exceeds_mtu(skb, mtu)) ++ return true; ++ ++ return false; ++} ++ ++static unsigned int ++nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb, ++ const struct nf_hook_state *state) ++{ ++ struct flow_offload_tuple_rhash *tuplehash; ++ struct nf_flowtable *flow_table = priv; ++ struct flow_offload_tuple tuple = {}; ++ enum flow_offload_tuple_dir dir; ++ struct flow_offload *flow; ++ struct net_device *outdev; ++ const struct rtable *rt; ++ struct iphdr *iph; ++ __be32 nexthop; ++ ++ if (skb->protocol != htons(ETH_P_IP)) ++ return NF_ACCEPT; ++ ++ if (nf_flow_tuple_ip(skb, state->in, &tuple) < 0) ++ return NF_ACCEPT; ++ ++ tuplehash = flow_offload_lookup(flow_table, &tuple); ++ if (tuplehash == NULL) ++ return NF_ACCEPT; ++ ++ outdev = dev_get_by_index_rcu(state->net, tuplehash->tuple.oifidx); ++ if (!outdev) ++ return NF_ACCEPT; ++ ++ dir = tuplehash->tuple.dir; ++ flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]); ++ ++ rt = (const struct rtable *)flow->tuplehash[dir].tuple.dst_cache; ++ if (unlikely(nf_flow_exceeds_mtu(skb, rt))) ++ return NF_ACCEPT; ++ ++ if (skb_try_make_writable(skb, sizeof(*iph))) ++ return NF_DROP; ++ ++ if (flow->flags & (FLOW_OFFLOAD_SNAT | FLOW_OFFLOAD_DNAT) && ++ nf_flow_nat_ip(flow, skb, dir) < 0) ++ return NF_DROP; ++ ++ flow->timeout = (u32)jiffies + NF_FLOW_TIMEOUT; ++ iph = ip_hdr(skb); ++ ip_decrease_ttl(iph); ++ ++ skb->dev = outdev; ++ nexthop = rt_nexthop(rt, flow->tuplehash[!dir].tuple.src_v4.s_addr); ++ neigh_xmit(NEIGH_ARP_TABLE, outdev, &nexthop, skb); ++ ++ return NF_STOLEN; ++} ++ ++static struct nf_flowtable_type flowtable_ipv4 = { ++ .family = NFPROTO_IPV4, ++ .params = &nf_flow_offload_rhash_params, ++ .gc = nf_flow_offload_work_gc, ++ .hook = nf_flow_offload_ip_hook, ++ .owner = THIS_MODULE, ++}; ++ ++static int __init nf_flow_ipv4_module_init(void) ++{ ++ nft_register_flowtable_type(&flowtable_ipv4); ++ ++ return 0; ++} ++ ++static void __exit nf_flow_ipv4_module_exit(void) ++{ ++ nft_unregister_flowtable_type(&flowtable_ipv4); ++} ++ ++module_init(nf_flow_ipv4_module_init); ++module_exit(nf_flow_ipv4_module_exit); ++ ++MODULE_LICENSE("GPL"); ++MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>"); ++MODULE_ALIAS_NF_FLOWTABLE(AF_INET); diff --git a/target/linux/generic/backport-4.19/324-v4.16-netfilter-flow-table-support-for-IPv6.patch b/target/linux/generic/backport-4.19/324-v4.16-netfilter-flow-table-support-for-IPv6.patch new file mode 100644 index 0000000000..3e7db09068 --- /dev/null +++ b/target/linux/generic/backport-4.19/324-v4.16-netfilter-flow-table-support-for-IPv6.patch @@ -0,0 +1,354 @@ +From: Pablo Neira Ayuso <pablo@netfilter.org> +Date: Sun, 7 Jan 2018 01:04:19 +0100 +Subject: [PATCH] netfilter: flow table support for IPv6 + +This patch adds the IPv6 flow table type, that implements the datapath +flow table to forward IPv6 traffic. + +This patch exports ip6_dst_mtu_forward() that is required to check for +mtu to pass up packets that need PMTUD handling to the classic +forwarding path. + +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + create mode 100644 net/ipv6/netfilter/nf_flow_table_ipv6.c + +--- a/include/net/ipv6.h ++++ b/include/net/ipv6.h +@@ -889,6 +889,8 @@ static inline struct sk_buff *ip6_finish + &inet6_sk(sk)->cork); + } + ++unsigned int ip6_dst_mtu_forward(const struct dst_entry *dst); ++ + int ip6_dst_lookup(struct net *net, struct sock *sk, struct dst_entry **dst, + struct flowi6 *fl6); + struct dst_entry *ip6_dst_lookup_flow(const struct sock *sk, struct flowi6 *fl6, +--- a/net/ipv6/ip6_output.c ++++ b/net/ipv6/ip6_output.c +@@ -381,7 +381,7 @@ static inline int ip6_forward_finish(str + return dst_output(net, sk, skb); + } + +-static unsigned int ip6_dst_mtu_forward(const struct dst_entry *dst) ++unsigned int ip6_dst_mtu_forward(const struct dst_entry *dst) + { + unsigned int mtu; + struct inet6_dev *idev; +@@ -401,6 +401,7 @@ static unsigned int ip6_dst_mtu_forward( + + return mtu; + } ++EXPORT_SYMBOL_GPL(ip6_dst_mtu_forward); + + static bool ip6_pkt_too_big(const struct sk_buff *skb, unsigned int mtu) + { +--- a/net/ipv6/netfilter/Kconfig ++++ b/net/ipv6/netfilter/Kconfig +@@ -99,6 +99,14 @@ config NFT_FIB_IPV6 + endif # NF_TABLES_IPV6 + endif # NF_TABLES + ++config NF_FLOW_TABLE_IPV6 ++ select NF_FLOW_TABLE ++ tristate "Netfilter flow table IPv6 module" ++ help ++ This option adds the flow table IPv6 support. ++ ++ To compile it as a module, choose M here. ++ + config NF_DUP_IPV6 + tristate "Netfilter IPv6 packet duplication to alternate destination" + depends on !NF_CONNTRACK || NF_CONNTRACK +--- a/net/ipv6/netfilter/Makefile ++++ b/net/ipv6/netfilter/Makefile +@@ -45,6 +45,9 @@ obj-$(CONFIG_NFT_REDIR_IPV6) += nft_redi + obj-$(CONFIG_NFT_DUP_IPV6) += nft_dup_ipv6.o + obj-$(CONFIG_NFT_FIB_IPV6) += nft_fib_ipv6.o + ++# flow table support ++obj-$(CONFIG_NF_FLOW_TABLE_IPV6) += nf_flow_table_ipv6.o ++ + # matches + obj-$(CONFIG_IP6_NF_MATCH_AH) += ip6t_ah.o + obj-$(CONFIG_IP6_NF_MATCH_EUI64) += ip6t_eui64.o +--- /dev/null ++++ b/net/ipv6/netfilter/nf_flow_table_ipv6.c +@@ -0,0 +1,277 @@ ++#include <linux/kernel.h> ++#include <linux/init.h> ++#include <linux/module.h> ++#include <linux/netfilter.h> ++#include <linux/rhashtable.h> ++#include <linux/ipv6.h> ++#include <linux/netdevice.h> ++#include <linux/ipv6.h> ++#include <net/ipv6.h> ++#include <net/ip6_route.h> ++#include <net/neighbour.h> ++#include <net/netfilter/nf_flow_table.h> ++#include <net/netfilter/nf_tables.h> ++/* For layer 4 checksum field offset. */ ++#include <linux/tcp.h> ++#include <linux/udp.h> ++ ++static int nf_flow_nat_ipv6_tcp(struct sk_buff *skb, unsigned int thoff, ++ struct in6_addr *addr, ++ struct in6_addr *new_addr) ++{ ++ struct tcphdr *tcph; ++ ++ if (!pskb_may_pull(skb, thoff + sizeof(*tcph)) || ++ skb_try_make_writable(skb, thoff + sizeof(*tcph))) ++ return -1; ++ ++ tcph = (void *)(skb_network_header(skb) + thoff); ++ inet_proto_csum_replace16(&tcph->check, skb, addr->s6_addr32, ++ new_addr->s6_addr32, true); ++ ++ return 0; ++} ++ ++static int nf_flow_nat_ipv6_udp(struct sk_buff *skb, unsigned int thoff, ++ struct in6_addr *addr, ++ struct in6_addr *new_addr) ++{ ++ struct udphdr *udph; ++ ++ if (!pskb_may_pull(skb, thoff + sizeof(*udph)) || ++ skb_try_make_writable(skb, thoff + sizeof(*udph))) ++ return -1; ++ ++ udph = (void *)(skb_network_header(skb) + thoff); ++ if (udph->check || skb->ip_summed == CHECKSUM_PARTIAL) { ++ inet_proto_csum_replace16(&udph->check, skb, addr->s6_addr32, ++ new_addr->s6_addr32, true); ++ if (!udph->check) ++ udph->check = CSUM_MANGLED_0; ++ } ++ ++ return 0; ++} ++ ++static int nf_flow_nat_ipv6_l4proto(struct sk_buff *skb, struct ipv6hdr *ip6h, ++ unsigned int thoff, struct in6_addr *addr, ++ struct in6_addr *new_addr) ++{ ++ switch (ip6h->nexthdr) { ++ case IPPROTO_TCP: ++ if (nf_flow_nat_ipv6_tcp(skb, thoff, addr, new_addr) < 0) ++ return NF_DROP; ++ break; ++ case IPPROTO_UDP: ++ if (nf_flow_nat_ipv6_udp(skb, thoff, addr, new_addr) < 0) ++ return NF_DROP; ++ break; ++ } ++ ++ return 0; ++} ++ ++static int nf_flow_snat_ipv6(const struct flow_offload *flow, ++ struct sk_buff *skb, struct ipv6hdr *ip6h, ++ unsigned int thoff, ++ enum flow_offload_tuple_dir dir) ++{ ++ struct in6_addr addr, new_addr; ++ ++ switch (dir) { ++ case FLOW_OFFLOAD_DIR_ORIGINAL: ++ addr = ip6h->saddr; ++ new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_v6; ++ ip6h->saddr = new_addr; ++ break; ++ case FLOW_OFFLOAD_DIR_REPLY: ++ addr = ip6h->daddr; ++ new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_v6; ++ ip6h->daddr = new_addr; ++ break; ++ default: ++ return -1; ++ } ++ ++ return nf_flow_nat_ipv6_l4proto(skb, ip6h, thoff, &addr, &new_addr); ++} ++ ++static int nf_flow_dnat_ipv6(const struct flow_offload *flow, ++ struct sk_buff *skb, struct ipv6hdr *ip6h, ++ unsigned int thoff, ++ enum flow_offload_tuple_dir dir) ++{ ++ struct in6_addr addr, new_addr; ++ ++ switch (dir) { ++ case FLOW_OFFLOAD_DIR_ORIGINAL: ++ addr = ip6h->daddr; ++ new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_v6; ++ ip6h->daddr = new_addr; ++ break; ++ case FLOW_OFFLOAD_DIR_REPLY: ++ addr = ip6h->saddr; ++ new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_v6; ++ ip6h->saddr = new_addr; ++ break; ++ default: ++ return -1; ++ } ++ ++ return nf_flow_nat_ipv6_l4proto(skb, ip6h, thoff, &addr, &new_addr); ++} ++ ++static int nf_flow_nat_ipv6(const struct flow_offload *flow, ++ struct sk_buff *skb, ++ enum flow_offload_tuple_dir dir) ++{ ++ struct ipv6hdr *ip6h = ipv6_hdr(skb); ++ unsigned int thoff = sizeof(*ip6h); ++ ++ if (flow->flags & FLOW_OFFLOAD_SNAT && ++ (nf_flow_snat_port(flow, skb, thoff, ip6h->nexthdr, dir) < 0 || ++ nf_flow_snat_ipv6(flow, skb, ip6h, thoff, dir) < 0)) ++ return -1; ++ if (flow->flags & FLOW_OFFLOAD_DNAT && ++ (nf_flow_dnat_port(flow, skb, thoff, ip6h->nexthdr, dir) < 0 || ++ nf_flow_dnat_ipv6(flow, skb, ip6h, thoff, dir) < 0)) ++ return -1; ++ ++ return 0; ++} ++ ++static int nf_flow_tuple_ipv6(struct sk_buff *skb, const struct net_device *dev, ++ struct flow_offload_tuple *tuple) ++{ ++ struct flow_ports *ports; ++ struct ipv6hdr *ip6h; ++ unsigned int thoff; ++ ++ if (!pskb_may_pull(skb, sizeof(*ip6h))) ++ return -1; ++ ++ ip6h = ipv6_hdr(skb); ++ ++ if (ip6h->nexthdr != IPPROTO_TCP && ++ ip6h->nexthdr != IPPROTO_UDP) ++ return -1; ++ ++ thoff = sizeof(*ip6h); ++ if (!pskb_may_pull(skb, thoff + sizeof(*ports))) ++ return -1; ++ ++ ports = (struct flow_ports *)(skb_network_header(skb) + thoff); ++ ++ tuple->src_v6 = ip6h->saddr; ++ tuple->dst_v6 = ip6h->daddr; ++ tuple->src_port = ports->source; ++ tuple->dst_port = ports->dest; ++ tuple->l3proto = AF_INET6; ++ tuple->l4proto = ip6h->nexthdr; ++ tuple->iifidx = dev->ifindex; ++ ++ return 0; ++} ++ ++/* Based on ip_exceeds_mtu(). */ ++static bool __nf_flow_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu) ++{ ++ if (skb->len <= mtu) ++ return false; ++ ++ if (skb_is_gso(skb) && skb_gso_validate_mtu(skb, mtu)) ++ return false; ++ ++ return true; ++} ++ ++static bool nf_flow_exceeds_mtu(struct sk_buff *skb, const struct rt6_info *rt) ++{ ++ u32 mtu; ++ ++ mtu = ip6_dst_mtu_forward(&rt->dst); ++ if (__nf_flow_exceeds_mtu(skb, mtu)) ++ return true; ++ ++ return false; ++} ++ ++static unsigned int ++nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb, ++ const struct nf_hook_state *state) ++{ ++ struct flow_offload_tuple_rhash *tuplehash; ++ struct nf_flowtable *flow_table = priv; ++ struct flow_offload_tuple tuple = {}; ++ enum flow_offload_tuple_dir dir; ++ struct flow_offload *flow; ++ struct net_device *outdev; ++ struct in6_addr *nexthop; ++ struct ipv6hdr *ip6h; ++ struct rt6_info *rt; ++ ++ if (skb->protocol != htons(ETH_P_IPV6)) ++ return NF_ACCEPT; ++ ++ if (nf_flow_tuple_ipv6(skb, state->in, &tuple) < 0) ++ return NF_ACCEPT; ++ ++ tuplehash = flow_offload_lookup(flow_table, &tuple); ++ if (tuplehash == NULL) ++ return NF_ACCEPT; ++ ++ outdev = dev_get_by_index_rcu(state->net, tuplehash->tuple.oifidx); ++ if (!outdev) ++ return NF_ACCEPT; ++ ++ dir = tuplehash->tuple.dir; ++ flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]); ++ ++ rt = (struct rt6_info *)flow->tuplehash[dir].tuple.dst_cache; ++ if (unlikely(nf_flow_exceeds_mtu(skb, rt))) ++ return NF_ACCEPT; ++ ++ if (skb_try_make_writable(skb, sizeof(*ip6h))) ++ return NF_DROP; ++ ++ if (flow->flags & (FLOW_OFFLOAD_SNAT | FLOW_OFFLOAD_DNAT) && ++ nf_flow_nat_ipv6(flow, skb, dir) < 0) ++ return NF_DROP; ++ ++ flow->timeout = (u32)jiffies + NF_FLOW_TIMEOUT; ++ ip6h = ipv6_hdr(skb); ++ ip6h->hop_limit--; ++ ++ skb->dev = outdev; ++ nexthop = rt6_nexthop(rt, &flow->tuplehash[!dir].tuple.src_v6); ++ neigh_xmit(NEIGH_ND_TABLE, outdev, nexthop, skb); ++ ++ return NF_STOLEN; ++} ++ ++static struct nf_flowtable_type flowtable_ipv6 = { ++ .family = NFPROTO_IPV6, ++ .params = &nf_flow_offload_rhash_params, ++ .gc = nf_flow_offload_work_gc, ++ .hook = nf_flow_offload_ipv6_hook, ++ .owner = THIS_MODULE, ++}; ++ ++static int __init nf_flow_ipv6_module_init(void) ++{ ++ nft_register_flowtable_type(&flowtable_ipv6); ++ ++ return 0; ++} ++ ++static void __exit nf_flow_ipv6_module_exit(void) ++{ ++ nft_unregister_flowtable_type(&flowtable_ipv6); ++} ++ ++module_init(nf_flow_ipv6_module_init); ++module_exit(nf_flow_ipv6_module_exit); ++ ++MODULE_LICENSE("GPL"); ++MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>"); ++MODULE_ALIAS_NF_FLOWTABLE(AF_INET6); diff --git a/target/linux/generic/backport-4.19/325-v4.16-netfilter-flow-table-support-for-the-mixed-IPv4-IPv6.patch b/target/linux/generic/backport-4.19/325-v4.16-netfilter-flow-table-support-for-the-mixed-IPv4-IPv6.patch new file mode 100644 index 0000000000..04948d88ab --- /dev/null +++ b/target/linux/generic/backport-4.19/325-v4.16-netfilter-flow-table-support-for-the-mixed-IPv4-IPv6.patch @@ -0,0 +1,141 @@ +From: Pablo Neira Ayuso <pablo@netfilter.org> +Date: Sun, 7 Jan 2018 01:04:22 +0100 +Subject: [PATCH] netfilter: flow table support for the mixed IPv4/IPv6 family + +This patch adds the IPv6 flow table type, that implements the datapath +flow table to forward IPv6 traffic. + +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + create mode 100644 net/netfilter/nf_flow_table_inet.c + +--- a/include/net/netfilter/nf_flow_table.h ++++ b/include/net/netfilter/nf_flow_table.h +@@ -111,6 +111,11 @@ struct flow_ports { + __be16 source, dest; + }; + ++unsigned int nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb, ++ const struct nf_hook_state *state); ++unsigned int nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb, ++ const struct nf_hook_state *state); ++ + #define MODULE_ALIAS_NF_FLOWTABLE(family) \ + MODULE_ALIAS("nf-flowtable-" __stringify(family)) + +--- a/net/ipv4/netfilter/nf_flow_table_ipv4.c ++++ b/net/ipv4/netfilter/nf_flow_table_ipv4.c +@@ -202,7 +202,7 @@ static bool nf_flow_exceeds_mtu(struct s + return false; + } + +-static unsigned int ++unsigned int + nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb, + const struct nf_hook_state *state) + { +@@ -254,6 +254,7 @@ nf_flow_offload_ip_hook(void *priv, stru + + return NF_STOLEN; + } ++EXPORT_SYMBOL_GPL(nf_flow_offload_ip_hook); + + static struct nf_flowtable_type flowtable_ipv4 = { + .family = NFPROTO_IPV4, +--- a/net/ipv6/netfilter/nf_flow_table_ipv6.c ++++ b/net/ipv6/netfilter/nf_flow_table_ipv6.c +@@ -196,7 +196,7 @@ static bool nf_flow_exceeds_mtu(struct s + return false; + } + +-static unsigned int ++unsigned int + nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb, + const struct nf_hook_state *state) + { +@@ -248,6 +248,7 @@ nf_flow_offload_ipv6_hook(void *priv, st + + return NF_STOLEN; + } ++EXPORT_SYMBOL_GPL(nf_flow_offload_ipv6_hook); + + static struct nf_flowtable_type flowtable_ipv6 = { + .family = NFPROTO_IPV6, +--- a/net/netfilter/Kconfig ++++ b/net/netfilter/Kconfig +@@ -667,6 +667,14 @@ endif # NF_TABLES_NETDEV + + endif # NF_TABLES + ++config NF_FLOW_TABLE_INET ++ select NF_FLOW_TABLE ++ tristate "Netfilter flow table mixed IPv4/IPv6 module" ++ help ++ This option adds the flow table mixed IPv4/IPv6 support. ++ ++ To compile it as a module, choose M here. ++ + config NF_FLOW_TABLE + tristate "Netfilter flow table module" + help +--- a/net/netfilter/Makefile ++++ b/net/netfilter/Makefile +@@ -112,6 +112,7 @@ obj-$(CONFIG_NFT_FWD_NETDEV) += nft_fwd_ + + # flow table infrastructure + obj-$(CONFIG_NF_FLOW_TABLE) += nf_flow_table.o ++obj-$(CONFIG_NF_FLOW_TABLE_INET) += nf_flow_table_inet.o + + # generic X tables + obj-$(CONFIG_NETFILTER_XTABLES) += x_tables.o xt_tcpudp.o +--- /dev/null ++++ b/net/netfilter/nf_flow_table_inet.c +@@ -0,0 +1,48 @@ ++#include <linux/kernel.h> ++#include <linux/init.h> ++#include <linux/module.h> ++#include <linux/netfilter.h> ++#include <linux/rhashtable.h> ++#include <net/netfilter/nf_flow_table.h> ++#include <net/netfilter/nf_tables.h> ++ ++static unsigned int ++nf_flow_offload_inet_hook(void *priv, struct sk_buff *skb, ++ const struct nf_hook_state *state) ++{ ++ switch (skb->protocol) { ++ case htons(ETH_P_IP): ++ return nf_flow_offload_ip_hook(priv, skb, state); ++ case htons(ETH_P_IPV6): ++ return nf_flow_offload_ipv6_hook(priv, skb, state); ++ } ++ ++ return NF_ACCEPT; ++} ++ ++static struct nf_flowtable_type flowtable_inet = { ++ .family = NFPROTO_INET, ++ .params = &nf_flow_offload_rhash_params, ++ .gc = nf_flow_offload_work_gc, ++ .hook = nf_flow_offload_inet_hook, ++ .owner = THIS_MODULE, ++}; ++ ++static int __init nf_flow_inet_module_init(void) ++{ ++ nft_register_flowtable_type(&flowtable_inet); ++ ++ return 0; ++} ++ ++static void __exit nf_flow_inet_module_exit(void) ++{ ++ nft_unregister_flowtable_type(&flowtable_inet); ++} ++ ++module_init(nf_flow_inet_module_init); ++module_exit(nf_flow_inet_module_exit); ++ ++MODULE_LICENSE("GPL"); ++MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>"); ++MODULE_ALIAS_NF_FLOWTABLE(1); /* NFPROTO_INET */ diff --git a/target/linux/generic/backport-4.19/326-v4.16-netfilter-nf_tables-flow-offload-expression.patch b/target/linux/generic/backport-4.19/326-v4.16-netfilter-nf_tables-flow-offload-expression.patch new file mode 100644 index 0000000000..0decc34105 --- /dev/null +++ b/target/linux/generic/backport-4.19/326-v4.16-netfilter-nf_tables-flow-offload-expression.patch @@ -0,0 +1,332 @@ +From: Pablo Neira Ayuso <pablo@netfilter.org> +Date: Sun, 7 Jan 2018 01:04:26 +0100 +Subject: [PATCH] netfilter: nf_tables: flow offload expression + +Add new instruction for the nf_tables VM that allows us to specify what +flows are offloaded into a given flow table via name. This new +instruction creates the flow entry and adds it to the flow table. + +Only established flows, ie. we have seen traffic in both directions, are +added to the flow table. You can still decide to offload entries at a +later stage via packet counting or checking the ct status in case you +want to offload assured conntracks. + +This new extension depends on the conntrack subsystem. + +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + create mode 100644 net/netfilter/nft_flow_offload.c + +--- a/include/uapi/linux/netfilter/nf_tables.h ++++ b/include/uapi/linux/netfilter/nf_tables.h +@@ -957,6 +957,17 @@ enum nft_ct_attributes { + }; + #define NFTA_CT_MAX (__NFTA_CT_MAX - 1) + ++/** ++ * enum nft_flow_attributes - ct offload expression attributes ++ * @NFTA_FLOW_TABLE_NAME: flow table name (NLA_STRING) ++ */ ++enum nft_offload_attributes { ++ NFTA_FLOW_UNSPEC, ++ NFTA_FLOW_TABLE_NAME, ++ __NFTA_FLOW_MAX, ++}; ++#define NFTA_FLOW_MAX (__NFTA_FLOW_MAX - 1) ++ + enum nft_limit_type { + NFT_LIMIT_PKTS, + NFT_LIMIT_PKT_BYTES +--- a/net/netfilter/Kconfig ++++ b/net/netfilter/Kconfig +@@ -515,6 +515,13 @@ config NFT_CT + This option adds the "ct" expression that you can use to match + connection tracking information such as the flow state. + ++config NFT_FLOW_OFFLOAD ++ depends on NF_CONNTRACK ++ tristate "Netfilter nf_tables hardware flow offload module" ++ help ++ This option adds the "flow_offload" expression that you can use to ++ choose what flows are placed into the hardware. ++ + config NFT_SET_RBTREE + tristate "Netfilter nf_tables rbtree set module" + help +--- a/net/netfilter/Makefile ++++ b/net/netfilter/Makefile +@@ -87,6 +87,7 @@ obj-$(CONFIG_NFT_META) += nft_meta.o + obj-$(CONFIG_NFT_RT) += nft_rt.o + obj-$(CONFIG_NFT_NUMGEN) += nft_numgen.o + obj-$(CONFIG_NFT_CT) += nft_ct.o ++obj-$(CONFIG_NFT_FLOW_OFFLOAD) += nft_flow_offload.o + obj-$(CONFIG_NFT_LIMIT) += nft_limit.o + obj-$(CONFIG_NFT_NAT) += nft_nat.o + obj-$(CONFIG_NFT_OBJREF) += nft_objref.o +--- /dev/null ++++ b/net/netfilter/nft_flow_offload.c +@@ -0,0 +1,264 @@ ++#include <linux/kernel.h> ++#include <linux/module.h> ++#include <linux/init.h> ++#include <linux/netlink.h> ++#include <linux/netfilter.h> ++#include <linux/workqueue.h> ++#include <linux/spinlock.h> ++#include <linux/netfilter/nf_tables.h> ++#include <net/ip.h> /* for ipv4 options. */ ++#include <net/netfilter/nf_tables.h> ++#include <net/netfilter/nf_tables_core.h> ++#include <net/netfilter/nf_conntrack_core.h> ++#include <linux/netfilter/nf_conntrack_common.h> ++#include <net/netfilter/nf_flow_table.h> ++ ++struct nft_flow_offload { ++ struct nft_flowtable *flowtable; ++}; ++ ++static int nft_flow_route(const struct nft_pktinfo *pkt, ++ const struct nf_conn *ct, ++ struct nf_flow_route *route, ++ enum ip_conntrack_dir dir) ++{ ++ struct dst_entry *this_dst = skb_dst(pkt->skb); ++ struct dst_entry *other_dst = NULL; ++ struct flowi fl; ++ ++ memset(&fl, 0, sizeof(fl)); ++ switch (nft_pf(pkt)) { ++ case NFPROTO_IPV4: ++ fl.u.ip4.daddr = ct->tuplehash[!dir].tuple.dst.u3.ip; ++ break; ++ case NFPROTO_IPV6: ++ fl.u.ip6.daddr = ct->tuplehash[!dir].tuple.dst.u3.in6; ++ break; ++ } ++ ++ nf_route(nft_net(pkt), &other_dst, &fl, false, nft_pf(pkt)); ++ if (!other_dst) ++ return -ENOENT; ++ ++ route->tuple[dir].dst = this_dst; ++ route->tuple[dir].ifindex = nft_in(pkt)->ifindex; ++ route->tuple[!dir].dst = other_dst; ++ route->tuple[!dir].ifindex = nft_out(pkt)->ifindex; ++ ++ return 0; ++} ++ ++static bool nft_flow_offload_skip(struct sk_buff *skb) ++{ ++ struct ip_options *opt = &(IPCB(skb)->opt); ++ ++ if (unlikely(opt->optlen)) ++ return true; ++ if (skb_sec_path(skb)) ++ return true; ++ ++ return false; ++} ++ ++static void nft_flow_offload_eval(const struct nft_expr *expr, ++ struct nft_regs *regs, ++ const struct nft_pktinfo *pkt) ++{ ++ struct nft_flow_offload *priv = nft_expr_priv(expr); ++ struct nf_flowtable *flowtable = &priv->flowtable->data; ++ enum ip_conntrack_info ctinfo; ++ struct nf_flow_route route; ++ struct flow_offload *flow; ++ enum ip_conntrack_dir dir; ++ struct nf_conn *ct; ++ int ret; ++ ++ if (nft_flow_offload_skip(pkt->skb)) ++ goto out; ++ ++ ct = nf_ct_get(pkt->skb, &ctinfo); ++ if (!ct) ++ goto out; ++ ++ switch (ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum) { ++ case IPPROTO_TCP: ++ case IPPROTO_UDP: ++ break; ++ default: ++ goto out; ++ } ++ ++ if (test_bit(IPS_HELPER_BIT, &ct->status)) ++ goto out; ++ ++ if (ctinfo == IP_CT_NEW || ++ ctinfo == IP_CT_RELATED) ++ goto out; ++ ++ if (test_and_set_bit(IPS_OFFLOAD_BIT, &ct->status)) ++ goto out; ++ ++ dir = CTINFO2DIR(ctinfo); ++ if (nft_flow_route(pkt, ct, &route, dir) < 0) ++ goto err_flow_route; ++ ++ flow = flow_offload_alloc(ct, &route); ++ if (!flow) ++ goto err_flow_alloc; ++ ++ ret = flow_offload_add(flowtable, flow); ++ if (ret < 0) ++ goto err_flow_add; ++ ++ return; ++ ++err_flow_add: ++ flow_offload_free(flow); ++err_flow_alloc: ++ dst_release(route.tuple[!dir].dst); ++err_flow_route: ++ clear_bit(IPS_OFFLOAD_BIT, &ct->status); ++out: ++ regs->verdict.code = NFT_BREAK; ++} ++ ++static int nft_flow_offload_validate(const struct nft_ctx *ctx, ++ const struct nft_expr *expr, ++ const struct nft_data **data) ++{ ++ unsigned int hook_mask = (1 << NF_INET_FORWARD); ++ ++ return nft_chain_validate_hooks(ctx->chain, hook_mask); ++} ++ ++static int nft_flow_offload_init(const struct nft_ctx *ctx, ++ const struct nft_expr *expr, ++ const struct nlattr * const tb[]) ++{ ++ struct nft_flow_offload *priv = nft_expr_priv(expr); ++ u8 genmask = nft_genmask_next(ctx->net); ++ struct nft_flowtable *flowtable; ++ ++ if (!tb[NFTA_FLOW_TABLE_NAME]) ++ return -EINVAL; ++ ++ flowtable = nf_tables_flowtable_lookup(ctx->table, ++ tb[NFTA_FLOW_TABLE_NAME], ++ genmask); ++ if (IS_ERR(flowtable)) ++ return PTR_ERR(flowtable); ++ ++ priv->flowtable = flowtable; ++ flowtable->use++; ++ ++ return nf_ct_netns_get(ctx->net, ctx->afi->family); ++} ++ ++static void nft_flow_offload_destroy(const struct nft_ctx *ctx, ++ const struct nft_expr *expr) ++{ ++ struct nft_flow_offload *priv = nft_expr_priv(expr); ++ ++ priv->flowtable->use--; ++ nf_ct_netns_put(ctx->net, ctx->afi->family); ++} ++ ++static int nft_flow_offload_dump(struct sk_buff *skb, const struct nft_expr *expr) ++{ ++ struct nft_flow_offload *priv = nft_expr_priv(expr); ++ ++ if (nla_put_string(skb, NFTA_FLOW_TABLE_NAME, priv->flowtable->name)) ++ goto nla_put_failure; ++ ++ return 0; ++ ++nla_put_failure: ++ return -1; ++} ++ ++static struct nft_expr_type nft_flow_offload_type; ++static const struct nft_expr_ops nft_flow_offload_ops = { ++ .type = &nft_flow_offload_type, ++ .size = NFT_EXPR_SIZE(sizeof(struct nft_flow_offload)), ++ .eval = nft_flow_offload_eval, ++ .init = nft_flow_offload_init, ++ .destroy = nft_flow_offload_destroy, ++ .validate = nft_flow_offload_validate, ++ .dump = nft_flow_offload_dump, ++}; ++ ++static struct nft_expr_type nft_flow_offload_type __read_mostly = { ++ .name = "flow_offload", ++ .ops = &nft_flow_offload_ops, ++ .maxattr = NFTA_FLOW_MAX, ++ .owner = THIS_MODULE, ++}; ++ ++static void flow_offload_iterate_cleanup(struct flow_offload *flow, void *data) ++{ ++ struct net_device *dev = data; ++ ++ if (dev && flow->tuplehash[0].tuple.iifidx != dev->ifindex) ++ return; ++ ++ flow_offload_dead(flow); ++} ++ ++static void nft_flow_offload_iterate_cleanup(struct nf_flowtable *flowtable, ++ void *data) ++{ ++ nf_flow_table_iterate(flowtable, flow_offload_iterate_cleanup, data); ++} ++ ++static int flow_offload_netdev_event(struct notifier_block *this, ++ unsigned long event, void *ptr) ++{ ++ struct net_device *dev = netdev_notifier_info_to_dev(ptr); ++ ++ if (event != NETDEV_DOWN) ++ return NOTIFY_DONE; ++ ++ nft_flow_table_iterate(dev_net(dev), nft_flow_offload_iterate_cleanup, dev); ++ ++ return NOTIFY_DONE; ++} ++ ++static struct notifier_block flow_offload_netdev_notifier = { ++ .notifier_call = flow_offload_netdev_event, ++}; ++ ++static int __init nft_flow_offload_module_init(void) ++{ ++ int err; ++ ++ register_netdevice_notifier(&flow_offload_netdev_notifier); ++ ++ err = nft_register_expr(&nft_flow_offload_type); ++ if (err < 0) ++ goto register_expr; ++ ++ return 0; ++ ++register_expr: ++ unregister_netdevice_notifier(&flow_offload_netdev_notifier); ++ return err; ++} ++ ++static void __exit nft_flow_offload_module_exit(void) ++{ ++ struct net *net; ++ ++ nft_unregister_expr(&nft_flow_offload_type); ++ unregister_netdevice_notifier(&flow_offload_netdev_notifier); ++ rtnl_lock(); ++ for_each_net(net) ++ nft_flow_table_iterate(net, nft_flow_offload_iterate_cleanup, NULL); ++ rtnl_unlock(); ++} ++ ++module_init(nft_flow_offload_module_init); ++module_exit(nft_flow_offload_module_exit); ++ ++MODULE_LICENSE("GPL"); ++MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>"); ++MODULE_ALIAS_NFT_EXPR("flow_offload"); diff --git a/target/linux/generic/backport-4.19/327-v4.16-netfilter-nf_tables-remove-nhooks-field-from-struct-.patch b/target/linux/generic/backport-4.19/327-v4.16-netfilter-nf_tables-remove-nhooks-field-from-struct-.patch new file mode 100644 index 0000000000..7d13a59424 --- /dev/null +++ b/target/linux/generic/backport-4.19/327-v4.16-netfilter-nf_tables-remove-nhooks-field-from-struct-.patch @@ -0,0 +1,113 @@ +From: Pablo Neira Ayuso <pablo@netfilter.org> +Date: Tue, 19 Dec 2017 13:53:45 +0100 +Subject: [PATCH] netfilter: nf_tables: remove nhooks field from struct + nft_af_info + +We already validate the hook through bitmask, so this check is +superfluous. When removing this, this patch is also fixing a bug in the +new flowtable codebase, since ctx->afi points to the table family +instead of the netdev family which is where the flowtable is really +hooked in. + +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + +--- a/include/net/netfilter/nf_tables.h ++++ b/include/net/netfilter/nf_tables.h +@@ -968,7 +968,6 @@ enum nft_af_flags { + * + * @list: used internally + * @family: address family +- * @nhooks: number of hooks in this family + * @owner: module owner + * @tables: used internally + * @flags: family flags +@@ -976,7 +975,6 @@ enum nft_af_flags { + struct nft_af_info { + struct list_head list; + int family; +- unsigned int nhooks; + struct module *owner; + struct list_head tables; + u32 flags; +--- a/net/bridge/netfilter/nf_tables_bridge.c ++++ b/net/bridge/netfilter/nf_tables_bridge.c +@@ -44,7 +44,6 @@ nft_do_chain_bridge(void *priv, + + static struct nft_af_info nft_af_bridge __read_mostly = { + .family = NFPROTO_BRIDGE, +- .nhooks = NF_BR_NUMHOOKS, + .owner = THIS_MODULE, + }; + +--- a/net/ipv4/netfilter/nf_tables_arp.c ++++ b/net/ipv4/netfilter/nf_tables_arp.c +@@ -29,7 +29,6 @@ nft_do_chain_arp(void *priv, + + static struct nft_af_info nft_af_arp __read_mostly = { + .family = NFPROTO_ARP, +- .nhooks = NF_ARP_NUMHOOKS, + .owner = THIS_MODULE, + }; + +--- a/net/ipv4/netfilter/nf_tables_ipv4.c ++++ b/net/ipv4/netfilter/nf_tables_ipv4.c +@@ -32,7 +32,6 @@ static unsigned int nft_do_chain_ipv4(vo + + static struct nft_af_info nft_af_ipv4 __read_mostly = { + .family = NFPROTO_IPV4, +- .nhooks = NF_INET_NUMHOOKS, + .owner = THIS_MODULE, + }; + +--- a/net/ipv6/netfilter/nf_tables_ipv6.c ++++ b/net/ipv6/netfilter/nf_tables_ipv6.c +@@ -30,7 +30,6 @@ static unsigned int nft_do_chain_ipv6(vo + + static struct nft_af_info nft_af_ipv6 __read_mostly = { + .family = NFPROTO_IPV6, +- .nhooks = NF_INET_NUMHOOKS, + .owner = THIS_MODULE, + }; + +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -1359,9 +1359,6 @@ static int nft_chain_parse_hook(struct n + return -EINVAL; + + hook->num = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM])); +- if (hook->num >= afi->nhooks) +- return -EINVAL; +- + hook->priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY])); + + type = chain_type[afi->family][NFT_CHAIN_T_DEFAULT]; +@@ -4987,7 +4984,7 @@ static int nf_tables_flowtable_parse_hoo + return -EINVAL; + + hooknum = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_NUM])); +- if (hooknum >= ctx->afi->nhooks) ++ if (hooknum != NF_NETDEV_INGRESS) + return -EINVAL; + + priority = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_PRIORITY])); +--- a/net/netfilter/nf_tables_inet.c ++++ b/net/netfilter/nf_tables_inet.c +@@ -40,7 +40,6 @@ static unsigned int nft_do_chain_inet(vo + + static struct nft_af_info nft_af_inet __read_mostly = { + .family = NFPROTO_INET, +- .nhooks = NF_INET_NUMHOOKS, + .owner = THIS_MODULE, + }; + +--- a/net/netfilter/nf_tables_netdev.c ++++ b/net/netfilter/nf_tables_netdev.c +@@ -40,7 +40,6 @@ nft_do_chain_netdev(void *priv, struct s + + static struct nft_af_info nft_af_netdev __read_mostly = { + .family = NFPROTO_NETDEV, +- .nhooks = NF_NETDEV_NUMHOOKS, + .owner = THIS_MODULE, + .flags = NFT_AF_NEEDS_DEV, + }; diff --git a/target/linux/generic/backport-4.19/328-v4.16-netfilter-nf_tables-fix-a-typo-in-nf_tables_getflowt.patch b/target/linux/generic/backport-4.19/328-v4.16-netfilter-nf_tables-fix-a-typo-in-nf_tables_getflowt.patch new file mode 100644 index 0000000000..62bca05110 --- /dev/null +++ b/target/linux/generic/backport-4.19/328-v4.16-netfilter-nf_tables-fix-a-typo-in-nf_tables_getflowt.patch @@ -0,0 +1,22 @@ +From: Wei Yongjun <weiyongjun1@huawei.com> +Date: Wed, 10 Jan 2018 07:04:54 +0000 +Subject: [PATCH] netfilter: nf_tables: fix a typo in nf_tables_getflowtable() + +Fix a typo, we should check 'flowtable' instead of 'table'. + +Fixes: 3b49e2e94e6e ("netfilter: nf_tables: add flow table netlink frontend") +Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com> +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -5411,7 +5411,7 @@ static int nf_tables_getflowtable(struct + + flowtable = nf_tables_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME], + genmask); +- if (IS_ERR(table)) ++ if (IS_ERR(flowtable)) + return PTR_ERR(flowtable); + + skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL); diff --git a/target/linux/generic/backport-4.19/329-v4.16-netfilter-improve-flow-table-Kconfig-dependencies.patch b/target/linux/generic/backport-4.19/329-v4.16-netfilter-improve-flow-table-Kconfig-dependencies.patch new file mode 100644 index 0000000000..0d5cd3bb4f --- /dev/null +++ b/target/linux/generic/backport-4.19/329-v4.16-netfilter-improve-flow-table-Kconfig-dependencies.patch @@ -0,0 +1,106 @@ +From: Arnd Bergmann <arnd@arndb.de> +Date: Wed, 10 Jan 2018 18:10:59 +0100 +Subject: [PATCH] netfilter: improve flow table Kconfig dependencies + +The newly added NF_FLOW_TABLE options cause some build failures in +randconfig kernels: + +- when CONFIG_NF_CONNTRACK is disabled, or is a loadable module but + NF_FLOW_TABLE is built-in: + + In file included from net/netfilter/nf_flow_table.c:8:0: + include/net/netfilter/nf_conntrack.h:59:22: error: field 'ct_general' has incomplete type + struct nf_conntrack ct_general; + include/net/netfilter/nf_conntrack.h: In function 'nf_ct_get': + include/net/netfilter/nf_conntrack.h:148:15: error: 'const struct sk_buff' has no member named '_nfct' + include/net/netfilter/nf_conntrack.h: In function 'nf_ct_put': + include/net/netfilter/nf_conntrack.h:157:2: error: implicit declaration of function 'nf_conntrack_put'; did you mean 'nf_ct_put'? [-Werror=implicit-function-declaration] + + net/netfilter/nf_flow_table.o: In function `nf_flow_offload_work_gc': + (.text+0x1540): undefined reference to `nf_ct_delete' + +- when CONFIG_NF_TABLES is disabled: + + In file included from net/ipv6/netfilter/nf_flow_table_ipv6.c:13:0: + include/net/netfilter/nf_tables.h: In function 'nft_gencursor_next': + include/net/netfilter/nf_tables.h:1189:14: error: 'const struct net' has no member named 'nft'; did you mean 'nf'? + + - when CONFIG_NF_FLOW_TABLE_INET is enabled, but NF_FLOW_TABLE_IPV4 + or NF_FLOW_TABLE_IPV6 are not, or are loadable modules + + net/netfilter/nf_flow_table_inet.o: In function `nf_flow_offload_inet_hook': + nf_flow_table_inet.c:(.text+0x94): undefined reference to `nf_flow_offload_ipv6_hook' + nf_flow_table_inet.c:(.text+0x40): undefined reference to `nf_flow_offload_ip_hook' + +- when CONFIG_NF_FLOW_TABLES is disabled, but the other options are + enabled: + + net/netfilter/nf_flow_table_inet.o: In function `nf_flow_offload_inet_hook': + nf_flow_table_inet.c:(.text+0x6c): undefined reference to `nf_flow_offload_ipv6_hook' + net/netfilter/nf_flow_table_inet.o: In function `nf_flow_inet_module_exit': + nf_flow_table_inet.c:(.exit.text+0x8): undefined reference to `nft_unregister_flowtable_type' + net/netfilter/nf_flow_table_inet.o: In function `nf_flow_inet_module_init': + nf_flow_table_inet.c:(.init.text+0x8): undefined reference to `nft_register_flowtable_type' + net/ipv4/netfilter/nf_flow_table_ipv4.o: In function `nf_flow_ipv4_module_exit': + nf_flow_table_ipv4.c:(.exit.text+0x8): undefined reference to `nft_unregister_flowtable_type' + net/ipv4/netfilter/nf_flow_table_ipv4.o: In function `nf_flow_ipv4_module_init': + nf_flow_table_ipv4.c:(.init.text+0x8): undefined reference to `nft_register_flowtable_type' + +This adds additional Kconfig dependencies to ensure that NF_CONNTRACK and NF_TABLES +are always visible from NF_FLOW_TABLE, and that the internal dependencies between +the four new modules are met. + +Fixes: 7c23b629a808 ("netfilter: flow table support for the mixed IPv4/IPv6 family") +Fixes: 0995210753a2 ("netfilter: flow table support for IPv6") +Fixes: 97add9f0d66d ("netfilter: flow table support for IPv4") +Signed-off-by: Arnd Bergmann <arnd@arndb.de> +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + +--- a/net/ipv4/netfilter/Kconfig ++++ b/net/ipv4/netfilter/Kconfig +@@ -79,8 +79,9 @@ config NF_TABLES_ARP + endif # NF_TABLES + + config NF_FLOW_TABLE_IPV4 +- select NF_FLOW_TABLE + tristate "Netfilter flow table IPv4 module" ++ depends on NF_CONNTRACK && NF_TABLES ++ select NF_FLOW_TABLE + help + This option adds the flow table IPv4 support. + +--- a/net/ipv6/netfilter/Kconfig ++++ b/net/ipv6/netfilter/Kconfig +@@ -100,8 +100,9 @@ endif # NF_TABLES_IPV6 + endif # NF_TABLES + + config NF_FLOW_TABLE_IPV6 +- select NF_FLOW_TABLE + tristate "Netfilter flow table IPv6 module" ++ depends on NF_CONNTRACK && NF_TABLES ++ select NF_FLOW_TABLE + help + This option adds the flow table IPv6 support. + +--- a/net/netfilter/Kconfig ++++ b/net/netfilter/Kconfig +@@ -675,8 +675,9 @@ endif # NF_TABLES_NETDEV + endif # NF_TABLES + + config NF_FLOW_TABLE_INET +- select NF_FLOW_TABLE + tristate "Netfilter flow table mixed IPv4/IPv6 module" ++ depends on NF_FLOW_TABLE_IPV4 && NF_FLOW_TABLE_IPV6 ++ select NF_FLOW_TABLE + help + This option adds the flow table mixed IPv4/IPv6 support. + +@@ -684,6 +685,7 @@ config NF_FLOW_TABLE_INET + + config NF_FLOW_TABLE + tristate "Netfilter flow table module" ++ depends on NF_CONNTRACK && NF_TABLES + help + This option adds the flow table core infrastructure. + diff --git a/target/linux/generic/backport-4.19/330-v4.16-netfilter-nf_tables-remove-flag-field-from-struct-nf.patch b/target/linux/generic/backport-4.19/330-v4.16-netfilter-nf_tables-remove-flag-field-from-struct-nf.patch new file mode 100644 index 0000000000..c599ad79c2 --- /dev/null +++ b/target/linux/generic/backport-4.19/330-v4.16-netfilter-nf_tables-remove-flag-field-from-struct-nf.patch @@ -0,0 +1,59 @@ +From: Pablo Neira Ayuso <pablo@netfilter.org> +Date: Tue, 19 Dec 2017 14:07:52 +0100 +Subject: [PATCH] netfilter: nf_tables: remove flag field from struct + nft_af_info + +Replace it by a direct check for the netdev protocol family. + +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + +--- a/include/net/netfilter/nf_tables.h ++++ b/include/net/netfilter/nf_tables.h +@@ -959,10 +959,6 @@ struct nft_table { + char *name; + }; + +-enum nft_af_flags { +- NFT_AF_NEEDS_DEV = (1 << 0), +-}; +- + /** + * struct nft_af_info - nf_tables address family info + * +@@ -970,14 +966,12 @@ enum nft_af_flags { + * @family: address family + * @owner: module owner + * @tables: used internally +- * @flags: family flags + */ + struct nft_af_info { + struct list_head list; + int family; + struct module *owner; + struct list_head tables; +- u32 flags; + }; + + int nft_register_afinfo(struct net *, struct nft_af_info *); +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -1376,7 +1376,7 @@ static int nft_chain_parse_hook(struct n + hook->type = type; + + hook->dev = NULL; +- if (afi->flags & NFT_AF_NEEDS_DEV) { ++ if (afi->family == NFPROTO_NETDEV) { + char ifname[IFNAMSIZ]; + + if (!ha[NFTA_HOOK_DEV]) { +--- a/net/netfilter/nf_tables_netdev.c ++++ b/net/netfilter/nf_tables_netdev.c +@@ -41,7 +41,6 @@ nft_do_chain_netdev(void *priv, struct s + static struct nft_af_info nft_af_netdev __read_mostly = { + .family = NFPROTO_NETDEV, + .owner = THIS_MODULE, +- .flags = NFT_AF_NEEDS_DEV, + }; + + static int nf_tables_netdev_init_net(struct net *net) diff --git a/target/linux/generic/backport-4.19/331-v4.16-netfilter-nf_tables-no-need-for-struct-nft_af_info-t.patch b/target/linux/generic/backport-4.19/331-v4.16-netfilter-nf_tables-no-need-for-struct-nft_af_info-t.patch new file mode 100644 index 0000000000..35c75a201e --- /dev/null +++ b/target/linux/generic/backport-4.19/331-v4.16-netfilter-nf_tables-no-need-for-struct-nft_af_info-t.patch @@ -0,0 +1,80 @@ +From: Pablo Neira Ayuso <pablo@netfilter.org> +Date: Tue, 19 Dec 2017 12:17:52 +0100 +Subject: [PATCH] netfilter: nf_tables: no need for struct nft_af_info to + enable/disable table + +nf_tables_table_enable() and nf_tables_table_disable() take a pointer to +struct nft_af_info that is never used, remove it. + +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -640,10 +640,7 @@ err: + return err; + } + +-static void _nf_tables_table_disable(struct net *net, +- const struct nft_af_info *afi, +- struct nft_table *table, +- u32 cnt) ++static void nft_table_disable(struct net *net, struct nft_table *table, u32 cnt) + { + struct nft_chain *chain; + u32 i = 0; +@@ -661,9 +658,7 @@ static void _nf_tables_table_disable(str + } + } + +-static int nf_tables_table_enable(struct net *net, +- const struct nft_af_info *afi, +- struct nft_table *table) ++static int nf_tables_table_enable(struct net *net, struct nft_table *table) + { + struct nft_chain *chain; + int err, i = 0; +@@ -683,15 +678,13 @@ static int nf_tables_table_enable(struct + return 0; + err: + if (i) +- _nf_tables_table_disable(net, afi, table, i); ++ nft_table_disable(net, table, i); + return err; + } + +-static void nf_tables_table_disable(struct net *net, +- const struct nft_af_info *afi, +- struct nft_table *table) ++static void nf_tables_table_disable(struct net *net, struct nft_table *table) + { +- _nf_tables_table_disable(net, afi, table, 0); ++ nft_table_disable(net, table, 0); + } + + static int nf_tables_updtable(struct nft_ctx *ctx) +@@ -720,7 +713,7 @@ static int nf_tables_updtable(struct nft + nft_trans_table_enable(trans) = false; + } else if (!(flags & NFT_TABLE_F_DORMANT) && + ctx->table->flags & NFT_TABLE_F_DORMANT) { +- ret = nf_tables_table_enable(ctx->net, ctx->afi, ctx->table); ++ ret = nf_tables_table_enable(ctx->net, ctx->table); + if (ret >= 0) { + ctx->table->flags &= ~NFT_TABLE_F_DORMANT; + nft_trans_table_enable(trans) = true; +@@ -5792,7 +5785,6 @@ static int nf_tables_commit(struct net * + if (nft_trans_table_update(trans)) { + if (!nft_trans_table_enable(trans)) { + nf_tables_table_disable(net, +- trans->ctx.afi, + trans->ctx.table); + trans->ctx.table->flags |= NFT_TABLE_F_DORMANT; + } +@@ -5956,7 +5948,6 @@ static int nf_tables_abort(struct net *n + if (nft_trans_table_update(trans)) { + if (nft_trans_table_enable(trans)) { + nf_tables_table_disable(net, +- trans->ctx.afi, + trans->ctx.table); + trans->ctx.table->flags |= NFT_TABLE_F_DORMANT; + } diff --git a/target/linux/generic/backport-4.19/332-v4.16-netfilter-nf_tables-remove-struct-nft_af_info-parame.patch b/target/linux/generic/backport-4.19/332-v4.16-netfilter-nf_tables-remove-struct-nft_af_info-parame.patch new file mode 100644 index 0000000000..086178ae20 --- /dev/null +++ b/target/linux/generic/backport-4.19/332-v4.16-netfilter-nf_tables-remove-struct-nft_af_info-parame.patch @@ -0,0 +1,60 @@ +From: Pablo Neira Ayuso <pablo@netfilter.org> +Date: Tue, 19 Dec 2017 13:40:22 +0100 +Subject: [PATCH] netfilter: nf_tables: remove struct nft_af_info parameter in + nf_tables_chain_type_lookup() + +Pass family number instead, this comes in preparation for the removal of +struct nft_af_info. + +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -452,7 +452,7 @@ static inline u64 nf_tables_alloc_handle + static const struct nf_chain_type *chain_type[NFPROTO_NUMPROTO][NFT_CHAIN_T_MAX]; + + static const struct nf_chain_type * +-__nf_tables_chain_type_lookup(int family, const struct nlattr *nla) ++__nf_tables_chain_type_lookup(const struct nlattr *nla, u8 family) + { + int i; + +@@ -465,22 +465,20 @@ __nf_tables_chain_type_lookup(int family + } + + static const struct nf_chain_type * +-nf_tables_chain_type_lookup(const struct nft_af_info *afi, +- const struct nlattr *nla, +- bool autoload) ++nf_tables_chain_type_lookup(const struct nlattr *nla, u8 family, bool autoload) + { + const struct nf_chain_type *type; + +- type = __nf_tables_chain_type_lookup(afi->family, nla); ++ type = __nf_tables_chain_type_lookup(nla, family); + if (type != NULL) + return type; + #ifdef CONFIG_MODULES + if (autoload) { + nfnl_unlock(NFNL_SUBSYS_NFTABLES); +- request_module("nft-chain-%u-%.*s", afi->family, ++ request_module("nft-chain-%u-%.*s", family, + nla_len(nla), (const char *)nla_data(nla)); + nfnl_lock(NFNL_SUBSYS_NFTABLES); +- type = __nf_tables_chain_type_lookup(afi->family, nla); ++ type = __nf_tables_chain_type_lookup(nla, family); + if (type != NULL) + return ERR_PTR(-EAGAIN); + } +@@ -1356,8 +1354,8 @@ static int nft_chain_parse_hook(struct n + + type = chain_type[afi->family][NFT_CHAIN_T_DEFAULT]; + if (nla[NFTA_CHAIN_TYPE]) { +- type = nf_tables_chain_type_lookup(afi, nla[NFTA_CHAIN_TYPE], +- create); ++ type = nf_tables_chain_type_lookup(nla[NFTA_CHAIN_TYPE], ++ afi->family, create); + if (IS_ERR(type)) + return PTR_ERR(type); + } diff --git a/target/linux/generic/backport-4.19/334-v4.15-netfilter-nf_tables-fix-potential-NULL-ptr-deref-in-.patch b/target/linux/generic/backport-4.19/334-v4.15-netfilter-nf_tables-fix-potential-NULL-ptr-deref-in-.patch new file mode 100644 index 0000000000..d140a33518 --- /dev/null +++ b/target/linux/generic/backport-4.19/334-v4.15-netfilter-nf_tables-fix-potential-NULL-ptr-deref-in-.patch @@ -0,0 +1,30 @@ +From: Hangbin Liu <liuhangbin@gmail.com> +Date: Mon, 25 Dec 2017 11:34:54 +0800 +Subject: [PATCH] netfilter: nf_tables: fix potential NULL-ptr deref in + nf_tables_dump_obj_done() + +If there is no NFTA_OBJ_TABLE and NFTA_OBJ_TYPE, the c.data will be NULL in +nf_tables_getobj(). So before free filter->table in nf_tables_dump_obj_done(), +we need to check if filter is NULL first. + +Fixes: e46abbcc05aa ("netfilter: nf_tables: Allow table names of up to 255 chars") +Signed-off-by: Hangbin Liu <liuhangbin@gmail.com> +Acked-by: Phil Sutter <phil@nwl.cc> +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -5330,8 +5330,10 @@ static int nf_tables_dump_flowtable_done + if (!filter) + return 0; + +- kfree(filter->table); +- kfree(filter); ++ if (filter) { ++ kfree(filter->table); ++ kfree(filter); ++ } + + return 0; + } diff --git a/target/linux/generic/backport-4.19/335-v4.16-netfilter-nf_tables-add-single-table-list-for-all-fa.patch b/target/linux/generic/backport-4.19/335-v4.16-netfilter-nf_tables-add-single-table-list-for-all-fa.patch new file mode 100644 index 0000000000..59ec44a482 --- /dev/null +++ b/target/linux/generic/backport-4.19/335-v4.16-netfilter-nf_tables-add-single-table-list-for-all-fa.patch @@ -0,0 +1,1450 @@ +From: Pablo Neira Ayuso <pablo@netfilter.org> +Date: Tue, 9 Jan 2018 02:38:03 +0100 +Subject: [PATCH] netfilter: nf_tables: add single table list for all families + +Place all existing user defined tables in struct net *, instead of +having one list per family. This saves us from one level of indentation +in netlink dump functions. + +Place pointer to struct nft_af_info in struct nft_table temporarily, as +we still need this to put back reference module reference counter on +table removal. + +This patch comes in preparation for the removal of struct nft_af_info. + +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + +--- a/include/net/netfilter/nf_tables.h ++++ b/include/net/netfilter/nf_tables.h +@@ -143,22 +143,22 @@ static inline void nft_data_debug(const + * struct nft_ctx - nf_tables rule/set context + * + * @net: net namespace +- * @afi: address family info + * @table: the table the chain is contained in + * @chain: the chain the rule is contained in + * @nla: netlink attributes + * @portid: netlink portID of the original message + * @seq: netlink sequence number ++ * @family: protocol family + * @report: notify via unicast netlink message + */ + struct nft_ctx { + struct net *net; +- struct nft_af_info *afi; + struct nft_table *table; + struct nft_chain *chain; + const struct nlattr * const *nla; + u32 portid; + u32 seq; ++ u8 family; + bool report; + }; + +@@ -944,6 +944,7 @@ unsigned int nft_do_chain(struct nft_pkt + * @use: number of chain references to this table + * @flags: table flag (see enum nft_table_flags) + * @genmask: generation mask ++ * @afinfo: address family info + * @name: name of the table + */ + struct nft_table { +@@ -956,6 +957,7 @@ struct nft_table { + u32 use; + u16 flags:14, + genmask:2; ++ struct nft_af_info *afi; + char *name; + }; + +@@ -965,13 +967,11 @@ struct nft_table { + * @list: used internally + * @family: address family + * @owner: module owner +- * @tables: used internally + */ + struct nft_af_info { + struct list_head list; + int family; + struct module *owner; +- struct list_head tables; + }; + + int nft_register_afinfo(struct net *, struct nft_af_info *); +--- a/include/net/netns/nftables.h ++++ b/include/net/netns/nftables.h +@@ -8,6 +8,7 @@ struct nft_af_info; + + struct netns_nftables { + struct list_head af_info; ++ struct list_head tables; + struct list_head commit_list; + struct nft_af_info *ipv4; + struct nft_af_info *ipv6; +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -37,7 +37,6 @@ static LIST_HEAD(nf_tables_flowtables); + */ + int nft_register_afinfo(struct net *net, struct nft_af_info *afi) + { +- INIT_LIST_HEAD(&afi->tables); + nfnl_lock(NFNL_SUBSYS_NFTABLES); + list_add_tail_rcu(&afi->list, &net->nft.af_info); + nfnl_unlock(NFNL_SUBSYS_NFTABLES); +@@ -99,13 +98,13 @@ static void nft_ctx_init(struct nft_ctx + struct net *net, + const struct sk_buff *skb, + const struct nlmsghdr *nlh, +- struct nft_af_info *afi, ++ u8 family, + struct nft_table *table, + struct nft_chain *chain, + const struct nlattr * const *nla) + { + ctx->net = net; +- ctx->afi = afi; ++ ctx->family = family; + ctx->table = table; + ctx->chain = chain; + ctx->nla = nla; +@@ -414,30 +413,31 @@ static int nft_delflowtable(struct nft_c + * Tables + */ + +-static struct nft_table *nft_table_lookup(const struct nft_af_info *afi, ++static struct nft_table *nft_table_lookup(const struct net *net, + const struct nlattr *nla, +- u8 genmask) ++ u8 family, u8 genmask) + { + struct nft_table *table; + +- list_for_each_entry(table, &afi->tables, list) { ++ list_for_each_entry(table, &net->nft.tables, list) { + if (!nla_strcmp(nla, table->name) && ++ table->afi->family == family && + nft_active_genmask(table, genmask)) + return table; + } + return NULL; + } + +-static struct nft_table *nf_tables_table_lookup(const struct nft_af_info *afi, ++static struct nft_table *nf_tables_table_lookup(const struct net *net, + const struct nlattr *nla, +- u8 genmask) ++ u8 family, u8 genmask) + { + struct nft_table *table; + + if (nla == NULL) + return ERR_PTR(-EINVAL); + +- table = nft_table_lookup(afi, nla, genmask); ++ table = nft_table_lookup(net, nla, family, genmask); + if (table != NULL) + return table; + +@@ -536,7 +536,7 @@ static void nf_tables_table_notify(const + goto err; + + err = nf_tables_fill_table_info(skb, ctx->net, ctx->portid, ctx->seq, +- event, 0, ctx->afi->family, ctx->table); ++ event, 0, ctx->family, ctx->table); + if (err < 0) { + kfree_skb(skb); + goto err; +@@ -553,7 +553,6 @@ static int nf_tables_dump_tables(struct + struct netlink_callback *cb) + { + const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); +- const struct nft_af_info *afi; + const struct nft_table *table; + unsigned int idx = 0, s_idx = cb->args[0]; + struct net *net = sock_net(skb->sk); +@@ -562,30 +561,27 @@ static int nf_tables_dump_tables(struct + rcu_read_lock(); + cb->seq = net->nft.base_seq; + +- list_for_each_entry_rcu(afi, &net->nft.af_info, list) { +- if (family != NFPROTO_UNSPEC && family != afi->family) ++ list_for_each_entry_rcu(table, &net->nft.tables, list) { ++ if (family != NFPROTO_UNSPEC && family != table->afi->family) + continue; + +- list_for_each_entry_rcu(table, &afi->tables, list) { +- if (idx < s_idx) +- goto cont; +- if (idx > s_idx) +- memset(&cb->args[1], 0, +- sizeof(cb->args) - sizeof(cb->args[0])); +- if (!nft_is_active(net, table)) +- continue; +- if (nf_tables_fill_table_info(skb, net, +- NETLINK_CB(cb->skb).portid, +- cb->nlh->nlmsg_seq, +- NFT_MSG_NEWTABLE, +- NLM_F_MULTI, +- afi->family, table) < 0) +- goto done; ++ if (idx < s_idx) ++ goto cont; ++ if (idx > s_idx) ++ memset(&cb->args[1], 0, ++ sizeof(cb->args) - sizeof(cb->args[0])); ++ if (!nft_is_active(net, table)) ++ continue; ++ if (nf_tables_fill_table_info(skb, net, ++ NETLINK_CB(cb->skb).portid, ++ cb->nlh->nlmsg_seq, ++ NFT_MSG_NEWTABLE, NLM_F_MULTI, ++ table->afi->family, table) < 0) ++ goto done; + +- nl_dump_check_consistent(cb, nlmsg_hdr(skb)); ++ nl_dump_check_consistent(cb, nlmsg_hdr(skb)); + cont: +- idx++; +- } ++ idx++; + } + done: + rcu_read_unlock(); +@@ -617,7 +613,8 @@ static int nf_tables_gettable(struct net + if (IS_ERR(afi)) + return PTR_ERR(afi); + +- table = nf_tables_table_lookup(afi, nla[NFTA_TABLE_NAME], genmask); ++ table = nf_tables_table_lookup(net, nla[NFTA_TABLE_NAME], afi->family, ++ genmask); + if (IS_ERR(table)) + return PTR_ERR(table); + +@@ -748,7 +745,7 @@ static int nf_tables_newtable(struct net + return PTR_ERR(afi); + + name = nla[NFTA_TABLE_NAME]; +- table = nf_tables_table_lookup(afi, name, genmask); ++ table = nf_tables_table_lookup(net, name, afi->family, genmask); + if (IS_ERR(table)) { + if (PTR_ERR(table) != -ENOENT) + return PTR_ERR(table); +@@ -758,7 +755,7 @@ static int nf_tables_newtable(struct net + if (nlh->nlmsg_flags & NLM_F_REPLACE) + return -EOPNOTSUPP; + +- nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla); ++ nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, NULL, nla); + return nf_tables_updtable(&ctx); + } + +@@ -785,14 +782,15 @@ static int nf_tables_newtable(struct net + INIT_LIST_HEAD(&table->sets); + INIT_LIST_HEAD(&table->objects); + INIT_LIST_HEAD(&table->flowtables); ++ table->afi = afi; + table->flags = flags; + +- nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla); ++ nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, NULL, nla); + err = nft_trans_table_add(&ctx, NFT_MSG_NEWTABLE); + if (err < 0) + goto err4; + +- list_add_tail_rcu(&table->list, &afi->tables); ++ list_add_tail_rcu(&table->list, &net->nft.tables); + return 0; + err4: + kfree(table->name); +@@ -866,30 +864,28 @@ out: + + static int nft_flush(struct nft_ctx *ctx, int family) + { +- struct nft_af_info *afi; + struct nft_table *table, *nt; + const struct nlattr * const *nla = ctx->nla; + int err = 0; + +- list_for_each_entry(afi, &ctx->net->nft.af_info, list) { +- if (family != AF_UNSPEC && afi->family != family) ++ list_for_each_entry_safe(table, nt, &ctx->net->nft.tables, list) { ++ if (family != AF_UNSPEC && table->afi->family != family) + continue; + +- ctx->afi = afi; +- list_for_each_entry_safe(table, nt, &afi->tables, list) { +- if (!nft_is_active_next(ctx->net, table)) +- continue; ++ ctx->family = table->afi->family; + +- if (nla[NFTA_TABLE_NAME] && +- nla_strcmp(nla[NFTA_TABLE_NAME], table->name) != 0) +- continue; ++ if (!nft_is_active_next(ctx->net, table)) ++ continue; + +- ctx->table = table; ++ if (nla[NFTA_TABLE_NAME] && ++ nla_strcmp(nla[NFTA_TABLE_NAME], table->name) != 0) ++ continue; + +- err = nft_flush_table(ctx); +- if (err < 0) +- goto out; +- } ++ ctx->table = table; ++ ++ err = nft_flush_table(ctx); ++ if (err < 0) ++ goto out; + } + out: + return err; +@@ -907,7 +903,7 @@ static int nf_tables_deltable(struct net + int family = nfmsg->nfgen_family; + struct nft_ctx ctx; + +- nft_ctx_init(&ctx, net, skb, nlh, NULL, NULL, NULL, nla); ++ nft_ctx_init(&ctx, net, skb, nlh, 0, NULL, NULL, nla); + if (family == AF_UNSPEC || nla[NFTA_TABLE_NAME] == NULL) + return nft_flush(&ctx, family); + +@@ -915,7 +911,8 @@ static int nf_tables_deltable(struct net + if (IS_ERR(afi)) + return PTR_ERR(afi); + +- table = nf_tables_table_lookup(afi, nla[NFTA_TABLE_NAME], genmask); ++ table = nf_tables_table_lookup(net, nla[NFTA_TABLE_NAME], afi->family, ++ genmask); + if (IS_ERR(table)) + return PTR_ERR(table); + +@@ -923,7 +920,7 @@ static int nf_tables_deltable(struct net + table->use > 0) + return -EBUSY; + +- ctx.afi = afi; ++ ctx.family = afi->family; + ctx.table = table; + + return nft_flush_table(&ctx); +@@ -935,7 +932,7 @@ static void nf_tables_table_destroy(stru + + kfree(ctx->table->name); + kfree(ctx->table); +- module_put(ctx->afi->owner); ++ module_put(ctx->table->afi->owner); + } + + int nft_register_chain_type(const struct nf_chain_type *ctype) +@@ -1136,7 +1133,7 @@ static void nf_tables_chain_notify(const + goto err; + + err = nf_tables_fill_chain_info(skb, ctx->net, ctx->portid, ctx->seq, +- event, 0, ctx->afi->family, ctx->table, ++ event, 0, ctx->family, ctx->table, + ctx->chain); + if (err < 0) { + kfree_skb(skb); +@@ -1154,7 +1151,6 @@ static int nf_tables_dump_chains(struct + struct netlink_callback *cb) + { + const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); +- const struct nft_af_info *afi; + const struct nft_table *table; + const struct nft_chain *chain; + unsigned int idx = 0, s_idx = cb->args[0]; +@@ -1164,31 +1160,30 @@ static int nf_tables_dump_chains(struct + rcu_read_lock(); + cb->seq = net->nft.base_seq; + +- list_for_each_entry_rcu(afi, &net->nft.af_info, list) { +- if (family != NFPROTO_UNSPEC && family != afi->family) ++ list_for_each_entry_rcu(table, &net->nft.tables, list) { ++ if (family != NFPROTO_UNSPEC && family != table->afi->family) + continue; + +- list_for_each_entry_rcu(table, &afi->tables, list) { +- list_for_each_entry_rcu(chain, &table->chains, list) { +- if (idx < s_idx) +- goto cont; +- if (idx > s_idx) +- memset(&cb->args[1], 0, +- sizeof(cb->args) - sizeof(cb->args[0])); +- if (!nft_is_active(net, chain)) +- continue; +- if (nf_tables_fill_chain_info(skb, net, +- NETLINK_CB(cb->skb).portid, +- cb->nlh->nlmsg_seq, +- NFT_MSG_NEWCHAIN, +- NLM_F_MULTI, +- afi->family, table, chain) < 0) +- goto done; ++ list_for_each_entry_rcu(chain, &table->chains, list) { ++ if (idx < s_idx) ++ goto cont; ++ if (idx > s_idx) ++ memset(&cb->args[1], 0, ++ sizeof(cb->args) - sizeof(cb->args[0])); ++ if (!nft_is_active(net, chain)) ++ continue; ++ if (nf_tables_fill_chain_info(skb, net, ++ NETLINK_CB(cb->skb).portid, ++ cb->nlh->nlmsg_seq, ++ NFT_MSG_NEWCHAIN, ++ NLM_F_MULTI, ++ table->afi->family, table, ++ chain) < 0) ++ goto done; + +- nl_dump_check_consistent(cb, nlmsg_hdr(skb)); ++ nl_dump_check_consistent(cb, nlmsg_hdr(skb)); + cont: +- idx++; +- } ++ idx++; + } + } + done: +@@ -1222,7 +1217,8 @@ static int nf_tables_getchain(struct net + if (IS_ERR(afi)) + return PTR_ERR(afi); + +- table = nf_tables_table_lookup(afi, nla[NFTA_CHAIN_TABLE], genmask); ++ table = nf_tables_table_lookup(net, nla[NFTA_CHAIN_TABLE], afi->family, ++ genmask); + if (IS_ERR(table)) + return PTR_ERR(table); + +@@ -1332,8 +1328,8 @@ struct nft_chain_hook { + + static int nft_chain_parse_hook(struct net *net, + const struct nlattr * const nla[], +- struct nft_af_info *afi, +- struct nft_chain_hook *hook, bool create) ++ struct nft_chain_hook *hook, u8 family, ++ bool create) + { + struct nlattr *ha[NFTA_HOOK_MAX + 1]; + const struct nf_chain_type *type; +@@ -1352,10 +1348,10 @@ static int nft_chain_parse_hook(struct n + hook->num = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM])); + hook->priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY])); + +- type = chain_type[afi->family][NFT_CHAIN_T_DEFAULT]; ++ type = chain_type[family][NFT_CHAIN_T_DEFAULT]; + if (nla[NFTA_CHAIN_TYPE]) { + type = nf_tables_chain_type_lookup(nla[NFTA_CHAIN_TYPE], +- afi->family, create); ++ family, create); + if (IS_ERR(type)) + return PTR_ERR(type); + } +@@ -1367,7 +1363,7 @@ static int nft_chain_parse_hook(struct n + hook->type = type; + + hook->dev = NULL; +- if (afi->family == NFPROTO_NETDEV) { ++ if (family == NFPROTO_NETDEV) { + char ifname[IFNAMSIZ]; + + if (!ha[NFTA_HOOK_DEV]) { +@@ -1402,7 +1398,6 @@ static int nf_tables_addchain(struct nft + { + const struct nlattr * const *nla = ctx->nla; + struct nft_table *table = ctx->table; +- struct nft_af_info *afi = ctx->afi; + struct nft_base_chain *basechain; + struct nft_stats __percpu *stats; + struct net *net = ctx->net; +@@ -1416,7 +1411,7 @@ static int nf_tables_addchain(struct nft + struct nft_chain_hook hook; + struct nf_hook_ops *ops; + +- err = nft_chain_parse_hook(net, nla, afi, &hook, create); ++ err = nft_chain_parse_hook(net, nla, &hook, family, create); + if (err < 0) + return err; + +@@ -1508,7 +1503,7 @@ static int nf_tables_updchain(struct nft + if (!nft_is_base_chain(chain)) + return -EBUSY; + +- err = nft_chain_parse_hook(ctx->net, nla, ctx->afi, &hook, ++ err = nft_chain_parse_hook(ctx->net, nla, &hook, ctx->family, + create); + if (err < 0) + return err; +@@ -1618,7 +1613,8 @@ static int nf_tables_newchain(struct net + if (IS_ERR(afi)) + return PTR_ERR(afi); + +- table = nf_tables_table_lookup(afi, nla[NFTA_CHAIN_TABLE], genmask); ++ table = nf_tables_table_lookup(net, nla[NFTA_CHAIN_TABLE], afi->family, ++ genmask); + if (IS_ERR(table)) + return PTR_ERR(table); + +@@ -1658,7 +1654,7 @@ static int nf_tables_newchain(struct net + } + } + +- nft_ctx_init(&ctx, net, skb, nlh, afi, table, chain, nla); ++ nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, chain, nla); + + if (chain != NULL) { + if (nlh->nlmsg_flags & NLM_F_EXCL) +@@ -1692,7 +1688,8 @@ static int nf_tables_delchain(struct net + if (IS_ERR(afi)) + return PTR_ERR(afi); + +- table = nf_tables_table_lookup(afi, nla[NFTA_CHAIN_TABLE], genmask); ++ table = nf_tables_table_lookup(net, nla[NFTA_CHAIN_TABLE], afi->family, ++ genmask); + if (IS_ERR(table)) + return PTR_ERR(table); + +@@ -1704,7 +1701,7 @@ static int nf_tables_delchain(struct net + chain->use > 0) + return -EBUSY; + +- nft_ctx_init(&ctx, net, skb, nlh, afi, table, chain, nla); ++ nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, chain, nla); + + use = chain->use; + list_for_each_entry(rule, &chain->rules, list) { +@@ -1869,7 +1866,7 @@ static int nf_tables_expr_parse(const st + if (err < 0) + return err; + +- type = nft_expr_type_get(ctx->afi->family, tb[NFTA_EXPR_NAME]); ++ type = nft_expr_type_get(ctx->family, tb[NFTA_EXPR_NAME]); + if (IS_ERR(type)) + return PTR_ERR(type); + +@@ -2093,7 +2090,7 @@ static void nf_tables_rule_notify(const + goto err; + + err = nf_tables_fill_rule_info(skb, ctx->net, ctx->portid, ctx->seq, +- event, 0, ctx->afi->family, ctx->table, ++ event, 0, ctx->family, ctx->table, + ctx->chain, rule); + if (err < 0) { + kfree_skb(skb); +@@ -2117,7 +2114,6 @@ static int nf_tables_dump_rules(struct s + { + const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); + const struct nft_rule_dump_ctx *ctx = cb->data; +- const struct nft_af_info *afi; + const struct nft_table *table; + const struct nft_chain *chain; + const struct nft_rule *rule; +@@ -2128,39 +2124,37 @@ static int nf_tables_dump_rules(struct s + rcu_read_lock(); + cb->seq = net->nft.base_seq; + +- list_for_each_entry_rcu(afi, &net->nft.af_info, list) { +- if (family != NFPROTO_UNSPEC && family != afi->family) ++ list_for_each_entry_rcu(table, &net->nft.tables, list) { ++ if (family != NFPROTO_UNSPEC && family != table->afi->family) ++ continue; ++ ++ if (ctx && ctx->table && strcmp(ctx->table, table->name) != 0) + continue; + +- list_for_each_entry_rcu(table, &afi->tables, list) { +- if (ctx && ctx->table && +- strcmp(ctx->table, table->name) != 0) ++ list_for_each_entry_rcu(chain, &table->chains, list) { ++ if (ctx && ctx->chain && ++ strcmp(ctx->chain, chain->name) != 0) + continue; + +- list_for_each_entry_rcu(chain, &table->chains, list) { +- if (ctx && ctx->chain && +- strcmp(ctx->chain, chain->name) != 0) +- continue; +- +- list_for_each_entry_rcu(rule, &chain->rules, list) { +- if (!nft_is_active(net, rule)) +- goto cont; +- if (idx < s_idx) +- goto cont; +- if (idx > s_idx) +- memset(&cb->args[1], 0, +- sizeof(cb->args) - sizeof(cb->args[0])); +- if (nf_tables_fill_rule_info(skb, net, NETLINK_CB(cb->skb).portid, +- cb->nlh->nlmsg_seq, +- NFT_MSG_NEWRULE, +- NLM_F_MULTI | NLM_F_APPEND, +- afi->family, table, chain, rule) < 0) +- goto done; ++ list_for_each_entry_rcu(rule, &chain->rules, list) { ++ if (!nft_is_active(net, rule)) ++ goto cont; ++ if (idx < s_idx) ++ goto cont; ++ if (idx > s_idx) ++ memset(&cb->args[1], 0, ++ sizeof(cb->args) - sizeof(cb->args[0])); ++ if (nf_tables_fill_rule_info(skb, net, NETLINK_CB(cb->skb).portid, ++ cb->nlh->nlmsg_seq, ++ NFT_MSG_NEWRULE, ++ NLM_F_MULTI | NLM_F_APPEND, ++ table->afi->family, ++ table, chain, rule) < 0) ++ goto done; + +- nl_dump_check_consistent(cb, nlmsg_hdr(skb)); ++ nl_dump_check_consistent(cb, nlmsg_hdr(skb)); + cont: +- idx++; +- } ++ idx++; + } + } + } +@@ -2238,7 +2232,8 @@ static int nf_tables_getrule(struct net + if (IS_ERR(afi)) + return PTR_ERR(afi); + +- table = nf_tables_table_lookup(afi, nla[NFTA_RULE_TABLE], genmask); ++ table = nf_tables_table_lookup(net, nla[NFTA_RULE_TABLE], afi->family, ++ genmask); + if (IS_ERR(table)) + return PTR_ERR(table); + +@@ -2322,7 +2317,8 @@ static int nf_tables_newrule(struct net + if (IS_ERR(afi)) + return PTR_ERR(afi); + +- table = nf_tables_table_lookup(afi, nla[NFTA_RULE_TABLE], genmask); ++ table = nf_tables_table_lookup(net, nla[NFTA_RULE_TABLE], afi->family, ++ genmask); + if (IS_ERR(table)) + return PTR_ERR(table); + +@@ -2361,7 +2357,7 @@ static int nf_tables_newrule(struct net + return PTR_ERR(old_rule); + } + +- nft_ctx_init(&ctx, net, skb, nlh, afi, table, chain, nla); ++ nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, chain, nla); + + n = 0; + size = 0; +@@ -2501,7 +2497,8 @@ static int nf_tables_delrule(struct net + if (IS_ERR(afi)) + return PTR_ERR(afi); + +- table = nf_tables_table_lookup(afi, nla[NFTA_RULE_TABLE], genmask); ++ table = nf_tables_table_lookup(net, nla[NFTA_RULE_TABLE], afi->family, ++ genmask); + if (IS_ERR(table)) + return PTR_ERR(table); + +@@ -2512,7 +2509,7 @@ static int nf_tables_delrule(struct net + return PTR_ERR(chain); + } + +- nft_ctx_init(&ctx, net, skb, nlh, afi, table, chain, nla); ++ nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, chain, nla); + + if (chain) { + if (nla[NFTA_RULE_HANDLE]) { +@@ -2710,13 +2707,13 @@ static int nft_ctx_init_from_setattr(str + if (afi == NULL) + return -EAFNOSUPPORT; + +- table = nf_tables_table_lookup(afi, nla[NFTA_SET_TABLE], +- genmask); ++ table = nf_tables_table_lookup(net, nla[NFTA_SET_TABLE], ++ afi->family, genmask); + if (IS_ERR(table)) + return PTR_ERR(table); + } + +- nft_ctx_init(ctx, net, skb, nlh, afi, table, NULL, nla); ++ nft_ctx_init(ctx, net, skb, nlh, afi->family, table, NULL, nla); + return 0; + } + +@@ -2844,7 +2841,7 @@ static int nf_tables_fill_set(struct sk_ + goto nla_put_failure; + + nfmsg = nlmsg_data(nlh); +- nfmsg->nfgen_family = ctx->afi->family; ++ nfmsg->nfgen_family = ctx->family; + nfmsg->version = NFNETLINK_V0; + nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff); + +@@ -2936,10 +2933,8 @@ static int nf_tables_dump_sets(struct sk + { + const struct nft_set *set; + unsigned int idx, s_idx = cb->args[0]; +- struct nft_af_info *afi; + struct nft_table *table, *cur_table = (struct nft_table *)cb->args[2]; + struct net *net = sock_net(skb->sk); +- int cur_family = cb->args[3]; + struct nft_ctx *ctx = cb->data, ctx_set; + + if (cb->args[1]) +@@ -2948,51 +2943,44 @@ static int nf_tables_dump_sets(struct sk + rcu_read_lock(); + cb->seq = net->nft.base_seq; + +- list_for_each_entry_rcu(afi, &net->nft.af_info, list) { +- if (ctx->afi && ctx->afi != afi) ++ list_for_each_entry_rcu(table, &net->nft.tables, list) { ++ if (ctx->family != NFPROTO_UNSPEC && ++ ctx->family != table->afi->family) + continue; + +- if (cur_family) { +- if (afi->family != cur_family) +- continue; ++ if (ctx->table && ctx->table != table) ++ continue; + +- cur_family = 0; +- } +- list_for_each_entry_rcu(table, &afi->tables, list) { +- if (ctx->table && ctx->table != table) ++ if (cur_table) { ++ if (cur_table != table) + continue; + +- if (cur_table) { +- if (cur_table != table) +- continue; ++ cur_table = NULL; ++ } ++ idx = 0; ++ list_for_each_entry_rcu(set, &table->sets, list) { ++ if (idx < s_idx) ++ goto cont; ++ if (!nft_is_active(net, set)) ++ goto cont; + +- cur_table = NULL; ++ ctx_set = *ctx; ++ ctx_set.table = table; ++ ctx_set.family = table->afi->family; ++ ++ if (nf_tables_fill_set(skb, &ctx_set, set, ++ NFT_MSG_NEWSET, ++ NLM_F_MULTI) < 0) { ++ cb->args[0] = idx; ++ cb->args[2] = (unsigned long) table; ++ goto done; + } +- idx = 0; +- list_for_each_entry_rcu(set, &table->sets, list) { +- if (idx < s_idx) +- goto cont; +- if (!nft_is_active(net, set)) +- goto cont; +- +- ctx_set = *ctx; +- ctx_set.table = table; +- ctx_set.afi = afi; +- if (nf_tables_fill_set(skb, &ctx_set, set, +- NFT_MSG_NEWSET, +- NLM_F_MULTI) < 0) { +- cb->args[0] = idx; +- cb->args[2] = (unsigned long) table; +- cb->args[3] = afi->family; +- goto done; +- } +- nl_dump_check_consistent(cb, nlmsg_hdr(skb)); ++ nl_dump_check_consistent(cb, nlmsg_hdr(skb)); + cont: +- idx++; +- } +- if (s_idx) +- s_idx = 0; ++ idx++; + } ++ if (s_idx) ++ s_idx = 0; + } + cb->args[1] = 1; + done: +@@ -3202,11 +3190,12 @@ static int nf_tables_newset(struct net * + if (IS_ERR(afi)) + return PTR_ERR(afi); + +- table = nf_tables_table_lookup(afi, nla[NFTA_SET_TABLE], genmask); ++ table = nf_tables_table_lookup(net, nla[NFTA_SET_TABLE], afi->family, ++ genmask); + if (IS_ERR(table)) + return PTR_ERR(table); + +- nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla); ++ nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, NULL, nla); + + set = nf_tables_set_lookup(table, nla[NFTA_SET_NAME], genmask); + if (IS_ERR(set)) { +@@ -3475,12 +3464,12 @@ static int nft_ctx_init_from_elemattr(st + if (IS_ERR(afi)) + return PTR_ERR(afi); + +- table = nf_tables_table_lookup(afi, nla[NFTA_SET_ELEM_LIST_TABLE], +- genmask); ++ table = nf_tables_table_lookup(net, nla[NFTA_SET_ELEM_LIST_TABLE], ++ afi->family, genmask); + if (IS_ERR(table)) + return PTR_ERR(table); + +- nft_ctx_init(ctx, net, skb, nlh, afi, table, NULL, nla); ++ nft_ctx_init(ctx, net, skb, nlh, afi->family, table, NULL, nla); + return 0; + } + +@@ -3585,7 +3574,6 @@ static int nf_tables_dump_set(struct sk_ + { + struct nft_set_dump_ctx *dump_ctx = cb->data; + struct net *net = sock_net(skb->sk); +- struct nft_af_info *afi; + struct nft_table *table; + struct nft_set *set; + struct nft_set_dump_args args; +@@ -3597,21 +3585,19 @@ static int nf_tables_dump_set(struct sk_ + int event; + + rcu_read_lock(); +- list_for_each_entry_rcu(afi, &net->nft.af_info, list) { +- if (afi != dump_ctx->ctx.afi) ++ list_for_each_entry_rcu(table, &net->nft.tables, list) { ++ if (dump_ctx->ctx.family != NFPROTO_UNSPEC && ++ dump_ctx->ctx.family != table->afi->family) + continue; + +- list_for_each_entry_rcu(table, &afi->tables, list) { +- if (table != dump_ctx->ctx.table) +- continue; ++ if (table != dump_ctx->ctx.table) ++ continue; + +- list_for_each_entry_rcu(set, &table->sets, list) { +- if (set == dump_ctx->set) { +- set_found = true; +- break; +- } ++ list_for_each_entry_rcu(set, &table->sets, list) { ++ if (set == dump_ctx->set) { ++ set_found = true; ++ break; + } +- break; + } + break; + } +@@ -3631,7 +3617,7 @@ static int nf_tables_dump_set(struct sk_ + goto nla_put_failure; + + nfmsg = nlmsg_data(nlh); +- nfmsg->nfgen_family = afi->family; ++ nfmsg->nfgen_family = table->afi->family; + nfmsg->version = NFNETLINK_V0; + nfmsg->res_id = htons(net->nft.base_seq & 0xffff); + +@@ -3733,7 +3719,7 @@ static int nf_tables_fill_setelem_info(s + goto nla_put_failure; + + nfmsg = nlmsg_data(nlh); +- nfmsg->nfgen_family = ctx->afi->family; ++ nfmsg->nfgen_family = ctx->family; + nfmsg->version = NFNETLINK_V0; + nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff); + +@@ -3977,7 +3963,7 @@ static int nft_add_set_elem(struct nft_c + list_for_each_entry(binding, &set->bindings, list) { + struct nft_ctx bind_ctx = { + .net = ctx->net, +- .afi = ctx->afi, ++ .family = ctx->family, + .table = ctx->table, + .chain = (struct nft_chain *)binding->chain, + }; +@@ -4527,7 +4513,8 @@ static int nf_tables_newobj(struct net * + if (IS_ERR(afi)) + return PTR_ERR(afi); + +- table = nf_tables_table_lookup(afi, nla[NFTA_OBJ_TABLE], genmask); ++ table = nf_tables_table_lookup(net, nla[NFTA_OBJ_TABLE], afi->family, ++ genmask); + if (IS_ERR(table)) + return PTR_ERR(table); + +@@ -4545,7 +4532,7 @@ static int nf_tables_newobj(struct net * + return 0; + } + +- nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla); ++ nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, NULL, nla); + + type = nft_obj_type_get(objtype); + if (IS_ERR(type)) +@@ -4622,7 +4609,6 @@ struct nft_obj_filter { + static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb) + { + const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); +- const struct nft_af_info *afi; + const struct nft_table *table; + unsigned int idx = 0, s_idx = cb->args[0]; + struct nft_obj_filter *filter = cb->data; +@@ -4637,38 +4623,37 @@ static int nf_tables_dump_obj(struct sk_ + rcu_read_lock(); + cb->seq = net->nft.base_seq; + +- list_for_each_entry_rcu(afi, &net->nft.af_info, list) { +- if (family != NFPROTO_UNSPEC && family != afi->family) ++ list_for_each_entry_rcu(table, &net->nft.tables, list) { ++ if (family != NFPROTO_UNSPEC && family != table->afi->family) + continue; + +- list_for_each_entry_rcu(table, &afi->tables, list) { +- list_for_each_entry_rcu(obj, &table->objects, list) { +- if (!nft_is_active(net, obj)) +- goto cont; +- if (idx < s_idx) +- goto cont; +- if (idx > s_idx) +- memset(&cb->args[1], 0, +- sizeof(cb->args) - sizeof(cb->args[0])); +- if (filter && filter->table && +- strcmp(filter->table, table->name)) +- goto cont; +- if (filter && +- filter->type != NFT_OBJECT_UNSPEC && +- obj->ops->type->type != filter->type) +- goto cont; ++ list_for_each_entry_rcu(obj, &table->objects, list) { ++ if (!nft_is_active(net, obj)) ++ goto cont; ++ if (idx < s_idx) ++ goto cont; ++ if (idx > s_idx) ++ memset(&cb->args[1], 0, ++ sizeof(cb->args) - sizeof(cb->args[0])); ++ if (filter && filter->table && ++ strcmp(filter->table, table->name)) ++ goto cont; ++ if (filter && ++ filter->type != NFT_OBJECT_UNSPEC && ++ obj->ops->type->type != filter->type) ++ goto cont; + +- if (nf_tables_fill_obj_info(skb, net, NETLINK_CB(cb->skb).portid, +- cb->nlh->nlmsg_seq, +- NFT_MSG_NEWOBJ, +- NLM_F_MULTI | NLM_F_APPEND, +- afi->family, table, obj, reset) < 0) +- goto done; ++ if (nf_tables_fill_obj_info(skb, net, NETLINK_CB(cb->skb).portid, ++ cb->nlh->nlmsg_seq, ++ NFT_MSG_NEWOBJ, ++ NLM_F_MULTI | NLM_F_APPEND, ++ table->afi->family, table, ++ obj, reset) < 0) ++ goto done; + +- nl_dump_check_consistent(cb, nlmsg_hdr(skb)); ++ nl_dump_check_consistent(cb, nlmsg_hdr(skb)); + cont: +- idx++; +- } ++ idx++; + } + } + done: +@@ -4755,7 +4740,8 @@ static int nf_tables_getobj(struct net * + if (IS_ERR(afi)) + return PTR_ERR(afi); + +- table = nf_tables_table_lookup(afi, nla[NFTA_OBJ_TABLE], genmask); ++ table = nf_tables_table_lookup(net, nla[NFTA_OBJ_TABLE], afi->family, ++ genmask); + if (IS_ERR(table)) + return PTR_ERR(table); + +@@ -4815,7 +4801,8 @@ static int nf_tables_delobj(struct net * + if (IS_ERR(afi)) + return PTR_ERR(afi); + +- table = nf_tables_table_lookup(afi, nla[NFTA_OBJ_TABLE], genmask); ++ table = nf_tables_table_lookup(net, nla[NFTA_OBJ_TABLE], afi->family, ++ genmask); + if (IS_ERR(table)) + return PTR_ERR(table); + +@@ -4826,7 +4813,7 @@ static int nf_tables_delobj(struct net * + if (obj->use > 0) + return -EBUSY; + +- nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla); ++ nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, NULL, nla); + + return nft_delobj(&ctx, obj); + } +@@ -4864,7 +4851,7 @@ static void nf_tables_obj_notify(const s + struct nft_object *obj, int event) + { + nft_obj_notify(ctx->net, ctx->table, obj, ctx->portid, ctx->seq, event, +- ctx->afi->family, ctx->report, GFP_KERNEL); ++ ctx->family, ctx->report, GFP_KERNEL); + } + + /* +@@ -5054,7 +5041,7 @@ void nft_flow_table_iterate(struct net * + + rcu_read_lock(); + list_for_each_entry_rcu(afi, &net->nft.af_info, list) { +- list_for_each_entry_rcu(table, &afi->tables, list) { ++ list_for_each_entry_rcu(table, &net->nft.tables, list) { + list_for_each_entry_rcu(flowtable, &table->flowtables, list) { + iter(&flowtable->data, data); + } +@@ -5102,7 +5089,8 @@ static int nf_tables_newflowtable(struct + if (IS_ERR(afi)) + return PTR_ERR(afi); + +- table = nf_tables_table_lookup(afi, nla[NFTA_FLOWTABLE_TABLE], genmask); ++ table = nf_tables_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], ++ afi->family, genmask); + if (IS_ERR(table)) + return PTR_ERR(table); + +@@ -5119,7 +5107,7 @@ static int nf_tables_newflowtable(struct + return 0; + } + +- nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla); ++ nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, NULL, nla); + + flowtable = kzalloc(sizeof(*flowtable), GFP_KERNEL); + if (!flowtable) +@@ -5200,7 +5188,8 @@ static int nf_tables_delflowtable(struct + if (IS_ERR(afi)) + return PTR_ERR(afi); + +- table = nf_tables_table_lookup(afi, nla[NFTA_FLOWTABLE_TABLE], genmask); ++ table = nf_tables_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], ++ afi->family, genmask); + if (IS_ERR(table)) + return PTR_ERR(table); + +@@ -5211,7 +5200,7 @@ static int nf_tables_delflowtable(struct + if (flowtable->use > 0) + return -EBUSY; + +- nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla); ++ nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, NULL, nla); + + return nft_delflowtable(&ctx, flowtable); + } +@@ -5280,40 +5269,37 @@ static int nf_tables_dump_flowtable(stru + struct net *net = sock_net(skb->sk); + int family = nfmsg->nfgen_family; + struct nft_flowtable *flowtable; +- const struct nft_af_info *afi; + const struct nft_table *table; + + rcu_read_lock(); + cb->seq = net->nft.base_seq; + +- list_for_each_entry_rcu(afi, &net->nft.af_info, list) { +- if (family != NFPROTO_UNSPEC && family != afi->family) ++ list_for_each_entry_rcu(table, &net->nft.tables, list) { ++ if (family != NFPROTO_UNSPEC && family != table->afi->family) + continue; + +- list_for_each_entry_rcu(table, &afi->tables, list) { +- list_for_each_entry_rcu(flowtable, &table->flowtables, list) { +- if (!nft_is_active(net, flowtable)) +- goto cont; +- if (idx < s_idx) +- goto cont; +- if (idx > s_idx) +- memset(&cb->args[1], 0, +- sizeof(cb->args) - sizeof(cb->args[0])); +- if (filter && filter->table[0] && +- strcmp(filter->table, table->name)) +- goto cont; ++ list_for_each_entry_rcu(flowtable, &table->flowtables, list) { ++ if (!nft_is_active(net, flowtable)) ++ goto cont; ++ if (idx < s_idx) ++ goto cont; ++ if (idx > s_idx) ++ memset(&cb->args[1], 0, ++ sizeof(cb->args) - sizeof(cb->args[0])); ++ if (filter && filter->table && ++ strcmp(filter->table, table->name)) ++ goto cont; + +- if (nf_tables_fill_flowtable_info(skb, net, NETLINK_CB(cb->skb).portid, +- cb->nlh->nlmsg_seq, +- NFT_MSG_NEWFLOWTABLE, +- NLM_F_MULTI | NLM_F_APPEND, +- afi->family, flowtable) < 0) +- goto done; ++ if (nf_tables_fill_flowtable_info(skb, net, NETLINK_CB(cb->skb).portid, ++ cb->nlh->nlmsg_seq, ++ NFT_MSG_NEWFLOWTABLE, ++ NLM_F_MULTI | NLM_F_APPEND, ++ table->afi->family, flowtable) < 0) ++ goto done; + +- nl_dump_check_consistent(cb, nlmsg_hdr(skb)); ++ nl_dump_check_consistent(cb, nlmsg_hdr(skb)); + cont: +- idx++; +- } ++ idx++; + } + } + done: +@@ -5398,7 +5384,8 @@ static int nf_tables_getflowtable(struct + if (IS_ERR(afi)) + return PTR_ERR(afi); + +- table = nf_tables_table_lookup(afi, nla[NFTA_FLOWTABLE_TABLE], genmask); ++ table = nf_tables_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], ++ afi->family, genmask); + if (IS_ERR(table)) + return PTR_ERR(table); + +@@ -5441,7 +5428,7 @@ static void nf_tables_flowtable_notify(s + + err = nf_tables_fill_flowtable_info(skb, ctx->net, ctx->portid, + ctx->seq, event, 0, +- ctx->afi->family, flowtable); ++ ctx->family, flowtable); + if (err < 0) { + kfree_skb(skb); + goto err; +@@ -5519,17 +5506,14 @@ static int nf_tables_flowtable_event(str + struct net_device *dev = netdev_notifier_info_to_dev(ptr); + struct nft_flowtable *flowtable; + struct nft_table *table; +- struct nft_af_info *afi; + + if (event != NETDEV_UNREGISTER) + return 0; + + nfnl_lock(NFNL_SUBSYS_NFTABLES); +- list_for_each_entry(afi, &dev_net(dev)->nft.af_info, list) { +- list_for_each_entry(table, &afi->tables, list) { +- list_for_each_entry(flowtable, &table->flowtables, list) { +- nft_flowtable_event(event, dev, flowtable); +- } ++ list_for_each_entry(table, &dev_net(dev)->nft.tables, list) { ++ list_for_each_entry(flowtable, &table->flowtables, list) { ++ nft_flowtable_event(event, dev, flowtable); + } + } + nfnl_unlock(NFNL_SUBSYS_NFTABLES); +@@ -6555,6 +6539,7 @@ EXPORT_SYMBOL_GPL(nft_data_dump); + static int __net_init nf_tables_init_net(struct net *net) + { + INIT_LIST_HEAD(&net->nft.af_info); ++ INIT_LIST_HEAD(&net->nft.tables); + INIT_LIST_HEAD(&net->nft.commit_list); + net->nft.base_seq = 1; + return 0; +@@ -6591,10 +6576,10 @@ static void __nft_release_afinfo(struct + struct nft_set *set, *ns; + struct nft_ctx ctx = { + .net = net, +- .afi = afi, ++ .family = afi->family, + }; + +- list_for_each_entry_safe(table, nt, &afi->tables, list) { ++ list_for_each_entry_safe(table, nt, &net->nft.tables, list) { + list_for_each_entry(chain, &table->chains, list) + nf_tables_unregister_hook(net, table, chain); + list_for_each_entry(flowtable, &table->flowtables, list) +--- a/net/netfilter/nf_tables_netdev.c ++++ b/net/netfilter/nf_tables_netdev.c +@@ -107,7 +107,6 @@ static int nf_tables_netdev_event(struct + unsigned long event, void *ptr) + { + struct net_device *dev = netdev_notifier_info_to_dev(ptr); +- struct nft_af_info *afi; + struct nft_table *table; + struct nft_chain *chain, *nr; + struct nft_ctx ctx = { +@@ -119,20 +118,18 @@ static int nf_tables_netdev_event(struct + return NOTIFY_DONE; + + nfnl_lock(NFNL_SUBSYS_NFTABLES); +- list_for_each_entry(afi, &dev_net(dev)->nft.af_info, list) { +- ctx.afi = afi; +- if (afi->family != NFPROTO_NETDEV) ++ list_for_each_entry(table, &ctx.net->nft.tables, list) { ++ if (table->afi->family != NFPROTO_NETDEV) + continue; + +- list_for_each_entry(table, &afi->tables, list) { +- ctx.table = table; +- list_for_each_entry_safe(chain, nr, &table->chains, list) { +- if (!nft_is_base_chain(chain)) +- continue; ++ ctx.family = table->afi->family; ++ ctx.table = table; ++ list_for_each_entry_safe(chain, nr, &table->chains, list) { ++ if (!nft_is_base_chain(chain)) ++ continue; + +- ctx.chain = chain; +- nft_netdev_event(event, dev, &ctx); +- } ++ ctx.chain = chain; ++ nft_netdev_event(event, dev, &ctx); + } + } + nfnl_unlock(NFNL_SUBSYS_NFTABLES); +--- a/net/netfilter/nft_compat.c ++++ b/net/netfilter/nft_compat.c +@@ -161,7 +161,7 @@ nft_target_set_tgchk_param(struct xt_tgc + { + par->net = ctx->net; + par->table = ctx->table->name; +- switch (ctx->afi->family) { ++ switch (ctx->family) { + case AF_INET: + entry->e4.ip.proto = proto; + entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0; +@@ -192,7 +192,7 @@ nft_target_set_tgchk_param(struct xt_tgc + } else { + par->hook_mask = 0; + } +- par->family = ctx->afi->family; ++ par->family = ctx->family; + par->nft_compat = true; + } + +@@ -282,7 +282,7 @@ nft_target_destroy(const struct nft_ctx + par.net = ctx->net; + par.target = target; + par.targinfo = info; +- par.family = ctx->afi->family; ++ par.family = ctx->family; + if (par.target->destroy != NULL) + par.target->destroy(&par); + +@@ -389,7 +389,7 @@ nft_match_set_mtchk_param(struct xt_mtch + { + par->net = ctx->net; + par->table = ctx->table->name; +- switch (ctx->afi->family) { ++ switch (ctx->family) { + case AF_INET: + entry->e4.ip.proto = proto; + entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0; +@@ -420,7 +420,7 @@ nft_match_set_mtchk_param(struct xt_mtch + } else { + par->hook_mask = 0; + } +- par->family = ctx->afi->family; ++ par->family = ctx->family; + par->nft_compat = true; + } + +@@ -502,7 +502,7 @@ __nft_match_destroy(const struct nft_ctx + par.net = ctx->net; + par.match = match; + par.matchinfo = info; +- par.family = ctx->afi->family; ++ par.family = ctx->family; + if (par.match->destroy != NULL) + par.match->destroy(&par); + +@@ -732,7 +732,7 @@ nft_match_select_ops(const struct nft_ct + + mt_name = nla_data(tb[NFTA_MATCH_NAME]); + rev = ntohl(nla_get_be32(tb[NFTA_MATCH_REV])); +- family = ctx->afi->family; ++ family = ctx->family; + + /* Re-use the existing match if it's already loaded. */ + list_for_each_entry(nft_match, &nft_match_list, head) { +@@ -823,7 +823,7 @@ nft_target_select_ops(const struct nft_c + + tg_name = nla_data(tb[NFTA_TARGET_NAME]); + rev = ntohl(nla_get_be32(tb[NFTA_TARGET_REV])); +- family = ctx->afi->family; ++ family = ctx->family; + + if (strcmp(tg_name, XT_ERROR_TARGET) == 0 || + strcmp(tg_name, XT_STANDARD_TARGET) == 0 || +--- a/net/netfilter/nft_ct.c ++++ b/net/netfilter/nft_ct.c +@@ -405,7 +405,7 @@ static int nft_ct_get_init(const struct + if (tb[NFTA_CT_DIRECTION] == NULL) + return -EINVAL; + +- switch (ctx->afi->family) { ++ switch (ctx->family) { + case NFPROTO_IPV4: + len = FIELD_SIZEOF(struct nf_conntrack_tuple, + src.u3.ip); +@@ -456,7 +456,7 @@ static int nft_ct_get_init(const struct + if (err < 0) + return err; + +- err = nf_ct_netns_get(ctx->net, ctx->afi->family); ++ err = nf_ct_netns_get(ctx->net, ctx->family); + if (err < 0) + return err; + +@@ -550,7 +550,7 @@ static int nft_ct_set_init(const struct + if (err < 0) + goto err1; + +- err = nf_ct_netns_get(ctx->net, ctx->afi->family); ++ err = nf_ct_netns_get(ctx->net, ctx->family); + if (err < 0) + goto err1; + +@@ -564,7 +564,7 @@ err1: + static void nft_ct_get_destroy(const struct nft_ctx *ctx, + const struct nft_expr *expr) + { +- nf_ct_netns_put(ctx->net, ctx->afi->family); ++ nf_ct_netns_put(ctx->net, ctx->family); + } + + static void nft_ct_set_destroy(const struct nft_ctx *ctx, +@@ -573,7 +573,7 @@ static void nft_ct_set_destroy(const str + struct nft_ct *priv = nft_expr_priv(expr); + + __nft_ct_set_destroy(ctx, priv); +- nf_ct_netns_put(ctx->net, ctx->afi->family); ++ nf_ct_netns_put(ctx->net, ctx->family); + } + + static int nft_ct_get_dump(struct sk_buff *skb, const struct nft_expr *expr) +@@ -734,7 +734,7 @@ static int nft_ct_helper_obj_init(const + struct nft_ct_helper_obj *priv = nft_obj_data(obj); + struct nf_conntrack_helper *help4, *help6; + char name[NF_CT_HELPER_NAME_LEN]; +- int family = ctx->afi->family; ++ int family = ctx->family; + + if (!tb[NFTA_CT_HELPER_NAME] || !tb[NFTA_CT_HELPER_L4PROTO]) + return -EINVAL; +@@ -753,14 +753,14 @@ static int nft_ct_helper_obj_init(const + + switch (family) { + case NFPROTO_IPV4: +- if (ctx->afi->family == NFPROTO_IPV6) ++ if (ctx->family == NFPROTO_IPV6) + return -EINVAL; + + help4 = nf_conntrack_helper_try_module_get(name, family, + priv->l4proto); + break; + case NFPROTO_IPV6: +- if (ctx->afi->family == NFPROTO_IPV4) ++ if (ctx->family == NFPROTO_IPV4) + return -EINVAL; + + help6 = nf_conntrack_helper_try_module_get(name, family, +--- a/net/netfilter/nft_flow_offload.c ++++ b/net/netfilter/nft_flow_offload.c +@@ -151,7 +151,7 @@ static int nft_flow_offload_init(const s + priv->flowtable = flowtable; + flowtable->use++; + +- return nf_ct_netns_get(ctx->net, ctx->afi->family); ++ return nf_ct_netns_get(ctx->net, ctx->family); + } + + static void nft_flow_offload_destroy(const struct nft_ctx *ctx, +@@ -160,7 +160,7 @@ static void nft_flow_offload_destroy(con + struct nft_flow_offload *priv = nft_expr_priv(expr); + + priv->flowtable->use--; +- nf_ct_netns_put(ctx->net, ctx->afi->family); ++ nf_ct_netns_put(ctx->net, ctx->family); + } + + static int nft_flow_offload_dump(struct sk_buff *skb, const struct nft_expr *expr) +--- a/net/netfilter/nft_log.c ++++ b/net/netfilter/nft_log.c +@@ -112,7 +112,7 @@ static int nft_log_init(const struct nft + break; + } + +- err = nf_logger_find_get(ctx->afi->family, li->type); ++ err = nf_logger_find_get(ctx->family, li->type); + if (err < 0) + goto err1; + +@@ -133,7 +133,7 @@ static void nft_log_destroy(const struct + if (priv->prefix != nft_log_null_prefix) + kfree(priv->prefix); + +- nf_logger_put(ctx->afi->family, li->type); ++ nf_logger_put(ctx->family, li->type); + } + + static int nft_log_dump(struct sk_buff *skb, const struct nft_expr *expr) +--- a/net/netfilter/nft_masq.c ++++ b/net/netfilter/nft_masq.c +@@ -73,7 +73,7 @@ int nft_masq_init(const struct nft_ctx * + } + } + +- return nf_ct_netns_get(ctx->net, ctx->afi->family); ++ return nf_ct_netns_get(ctx->net, ctx->family); + } + EXPORT_SYMBOL_GPL(nft_masq_init); + +--- a/net/netfilter/nft_meta.c ++++ b/net/netfilter/nft_meta.c +@@ -341,7 +341,7 @@ static int nft_meta_get_validate(const s + if (priv->key != NFT_META_SECPATH) + return 0; + +- switch (ctx->afi->family) { ++ switch (ctx->family) { + case NFPROTO_NETDEV: + hooks = 1 << NF_NETDEV_INGRESS; + break; +@@ -372,7 +372,7 @@ int nft_meta_set_validate(const struct n + if (priv->key != NFT_META_PKTTYPE) + return 0; + +- switch (ctx->afi->family) { ++ switch (ctx->family) { + case NFPROTO_BRIDGE: + hooks = 1 << NF_BR_PRE_ROUTING; + break; +--- a/net/netfilter/nft_nat.c ++++ b/net/netfilter/nft_nat.c +@@ -142,7 +142,7 @@ static int nft_nat_init(const struct nft + return -EINVAL; + + family = ntohl(nla_get_be32(tb[NFTA_NAT_FAMILY])); +- if (family != ctx->afi->family) ++ if (family != ctx->family) + return -EOPNOTSUPP; + + switch (family) { +--- a/net/netfilter/nft_redir.c ++++ b/net/netfilter/nft_redir.c +@@ -75,7 +75,7 @@ int nft_redir_init(const struct nft_ctx + return -EINVAL; + } + +- return nf_ct_netns_get(ctx->net, ctx->afi->family); ++ return nf_ct_netns_get(ctx->net, ctx->family); + } + EXPORT_SYMBOL_GPL(nft_redir_init); + diff --git a/target/linux/generic/backport-4.19/336-v4.15-netfilter-exit_net-cleanup-check-added.patch b/target/linux/generic/backport-4.19/336-v4.15-netfilter-exit_net-cleanup-check-added.patch new file mode 100644 index 0000000000..5938a9ba5a --- /dev/null +++ b/target/linux/generic/backport-4.19/336-v4.15-netfilter-exit_net-cleanup-check-added.patch @@ -0,0 +1,100 @@ +From: Vasily Averin <vvs@virtuozzo.com> +Date: Sun, 12 Nov 2017 14:32:37 +0300 +Subject: [PATCH] netfilter: exit_net cleanup check added + +Be sure that lists initialized in net_init hook was return to initial +state. + +Signed-off-by: Vasily Averin <vvs@virtuozzo.com> +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + +--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c ++++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c +@@ -834,6 +834,7 @@ static void clusterip_net_exit(struct ne + cn->procdir = NULL; + #endif + nf_unregister_net_hook(net, &cip_arp_ops); ++ WARN_ON_ONCE(!list_empty(&cn->configs)); + } + + static struct pernet_operations clusterip_net_ops = { +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -6545,6 +6545,12 @@ static int __net_init nf_tables_init_net + return 0; + } + ++static void __net_exit nf_tables_exit_net(struct net *net) ++{ ++ WARN_ON_ONCE(!list_empty(&net->nft.af_info)); ++ WARN_ON_ONCE(!list_empty(&net->nft.commit_list)); ++} ++ + int __nft_release_basechain(struct nft_ctx *ctx) + { + struct nft_rule *rule, *nr; +@@ -6622,6 +6628,7 @@ static void __nft_release_afinfo(struct + + static struct pernet_operations nf_tables_net_ops = { + .init = nf_tables_init_net, ++ .exit = nf_tables_exit_net, + }; + + static int __init nf_tables_module_init(void) +--- a/net/netfilter/nfnetlink_log.c ++++ b/net/netfilter/nfnetlink_log.c +@@ -1093,10 +1093,15 @@ static int __net_init nfnl_log_net_init( + + static void __net_exit nfnl_log_net_exit(struct net *net) + { ++ struct nfnl_log_net *log = nfnl_log_pernet(net); ++ unsigned int i; ++ + #ifdef CONFIG_PROC_FS + remove_proc_entry("nfnetlink_log", net->nf.proc_netfilter); + #endif + nf_log_unset(net, &nfulnl_logger); ++ for (i = 0; i < INSTANCE_BUCKETS; i++) ++ WARN_ON_ONCE(!hlist_empty(&log->instance_table[i])); + } + + static struct pernet_operations nfnl_log_net_ops = { +--- a/net/netfilter/nfnetlink_queue.c ++++ b/net/netfilter/nfnetlink_queue.c +@@ -1510,10 +1510,15 @@ static int __net_init nfnl_queue_net_ini + + static void __net_exit nfnl_queue_net_exit(struct net *net) + { ++ struct nfnl_queue_net *q = nfnl_queue_pernet(net); ++ unsigned int i; ++ + nf_unregister_queue_handler(net); + #ifdef CONFIG_PROC_FS + remove_proc_entry("nfnetlink_queue", net->nf.proc_netfilter); + #endif ++ for (i = 0; i < INSTANCE_BUCKETS; i++) ++ WARN_ON_ONCE(!hlist_empty(&q->instance_table[i])); + } + + static void nfnl_queue_net_exit_batch(struct list_head *net_exit_list) +--- a/net/netfilter/x_tables.c ++++ b/net/netfilter/x_tables.c +@@ -1785,8 +1785,17 @@ static int __net_init xt_net_init(struct + return 0; + } + ++static void __net_exit xt_net_exit(struct net *net) ++{ ++ int i; ++ ++ for (i = 0; i < NFPROTO_NUMPROTO; i++) ++ WARN_ON_ONCE(!list_empty(&net->xt.tables[i])); ++} ++ + static struct pernet_operations xt_net_ops = { + .init = xt_net_init, ++ .exit = xt_net_exit, + }; + + static int __init xt_init(void) diff --git a/target/linux/generic/backport-4.19/337-v4.16-netfilter-nf_tables-get-rid-of-pernet-families.patch b/target/linux/generic/backport-4.19/337-v4.16-netfilter-nf_tables-get-rid-of-pernet-families.patch new file mode 100644 index 0000000000..de5c2409b3 --- /dev/null +++ b/target/linux/generic/backport-4.19/337-v4.16-netfilter-nf_tables-get-rid-of-pernet-families.patch @@ -0,0 +1,598 @@ +From: Pablo Neira Ayuso <pablo@netfilter.org> +Date: Tue, 9 Jan 2018 02:42:11 +0100 +Subject: [PATCH] netfilter: nf_tables: get rid of pernet families + +Now that we have a single table list for each netns, we can get rid of +one pointer per family and the global afinfo list, thus, shrinking +struct netns for nftables that now becomes 64 bytes smaller. + +And call __nft_release_afinfo() from __net_exit path accordingly to +release netnamespace objects on removal. + +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + +--- a/include/net/netfilter/nf_tables.h ++++ b/include/net/netfilter/nf_tables.h +@@ -974,8 +974,8 @@ struct nft_af_info { + struct module *owner; + }; + +-int nft_register_afinfo(struct net *, struct nft_af_info *); +-void nft_unregister_afinfo(struct net *, struct nft_af_info *); ++int nft_register_afinfo(struct nft_af_info *); ++void nft_unregister_afinfo(struct nft_af_info *); + + int nft_register_chain_type(const struct nf_chain_type *); + void nft_unregister_chain_type(const struct nf_chain_type *); +--- a/include/net/netns/nftables.h ++++ b/include/net/netns/nftables.h +@@ -7,15 +7,8 @@ + struct nft_af_info; + + struct netns_nftables { +- struct list_head af_info; + struct list_head tables; + struct list_head commit_list; +- struct nft_af_info *ipv4; +- struct nft_af_info *ipv6; +- struct nft_af_info *inet; +- struct nft_af_info *arp; +- struct nft_af_info *bridge; +- struct nft_af_info *netdev; + unsigned int base_seq; + u8 gencursor; + }; +--- a/net/bridge/netfilter/nf_tables_bridge.c ++++ b/net/bridge/netfilter/nf_tables_bridge.c +@@ -47,34 +47,6 @@ static struct nft_af_info nft_af_bridge + .owner = THIS_MODULE, + }; + +-static int nf_tables_bridge_init_net(struct net *net) +-{ +- net->nft.bridge = kmalloc(sizeof(struct nft_af_info), GFP_KERNEL); +- if (net->nft.bridge == NULL) +- return -ENOMEM; +- +- memcpy(net->nft.bridge, &nft_af_bridge, sizeof(nft_af_bridge)); +- +- if (nft_register_afinfo(net, net->nft.bridge) < 0) +- goto err; +- +- return 0; +-err: +- kfree(net->nft.bridge); +- return -ENOMEM; +-} +- +-static void nf_tables_bridge_exit_net(struct net *net) +-{ +- nft_unregister_afinfo(net, net->nft.bridge); +- kfree(net->nft.bridge); +-} +- +-static struct pernet_operations nf_tables_bridge_net_ops = { +- .init = nf_tables_bridge_init_net, +- .exit = nf_tables_bridge_exit_net, +-}; +- + static const struct nf_chain_type filter_bridge = { + .name = "filter", + .type = NFT_CHAIN_T_DEFAULT, +@@ -98,17 +70,17 @@ static int __init nf_tables_bridge_init( + { + int ret; + +- ret = nft_register_chain_type(&filter_bridge); ++ ret = nft_register_afinfo(&nft_af_bridge); + if (ret < 0) + return ret; + +- ret = register_pernet_subsys(&nf_tables_bridge_net_ops); ++ ret = nft_register_chain_type(&filter_bridge); + if (ret < 0) +- goto err_register_subsys; ++ goto err_register_chain; + + return ret; + +-err_register_subsys: ++err_register_chain: + nft_unregister_chain_type(&filter_bridge); + + return ret; +@@ -116,8 +88,8 @@ err_register_subsys: + + static void __exit nf_tables_bridge_exit(void) + { +- unregister_pernet_subsys(&nf_tables_bridge_net_ops); + nft_unregister_chain_type(&filter_bridge); ++ nft_unregister_afinfo(&nft_af_bridge); + } + + module_init(nf_tables_bridge_init); +--- a/net/ipv4/netfilter/nf_tables_arp.c ++++ b/net/ipv4/netfilter/nf_tables_arp.c +@@ -32,34 +32,6 @@ static struct nft_af_info nft_af_arp __r + .owner = THIS_MODULE, + }; + +-static int nf_tables_arp_init_net(struct net *net) +-{ +- net->nft.arp = kmalloc(sizeof(struct nft_af_info), GFP_KERNEL); +- if (net->nft.arp== NULL) +- return -ENOMEM; +- +- memcpy(net->nft.arp, &nft_af_arp, sizeof(nft_af_arp)); +- +- if (nft_register_afinfo(net, net->nft.arp) < 0) +- goto err; +- +- return 0; +-err: +- kfree(net->nft.arp); +- return -ENOMEM; +-} +- +-static void nf_tables_arp_exit_net(struct net *net) +-{ +- nft_unregister_afinfo(net, net->nft.arp); +- kfree(net->nft.arp); +-} +- +-static struct pernet_operations nf_tables_arp_net_ops = { +- .init = nf_tables_arp_init_net, +- .exit = nf_tables_arp_exit_net, +-}; +- + static const struct nf_chain_type filter_arp = { + .name = "filter", + .type = NFT_CHAIN_T_DEFAULT, +@@ -77,21 +49,26 @@ static int __init nf_tables_arp_init(voi + { + int ret; + +- ret = nft_register_chain_type(&filter_arp); ++ ret = nft_register_afinfo(&nft_af_arp); + if (ret < 0) + return ret; + +- ret = register_pernet_subsys(&nf_tables_arp_net_ops); ++ ret = nft_register_chain_type(&filter_arp); + if (ret < 0) +- nft_unregister_chain_type(&filter_arp); ++ goto err_register_chain; ++ ++ return 0; ++ ++err_register_chain: ++ nft_unregister_chain_type(&filter_arp); + + return ret; + } + + static void __exit nf_tables_arp_exit(void) + { +- unregister_pernet_subsys(&nf_tables_arp_net_ops); + nft_unregister_chain_type(&filter_arp); ++ nft_unregister_afinfo(&nft_af_arp); + } + + module_init(nf_tables_arp_init); +--- a/net/ipv4/netfilter/nf_tables_ipv4.c ++++ b/net/ipv4/netfilter/nf_tables_ipv4.c +@@ -35,34 +35,6 @@ static struct nft_af_info nft_af_ipv4 __ + .owner = THIS_MODULE, + }; + +-static int nf_tables_ipv4_init_net(struct net *net) +-{ +- net->nft.ipv4 = kmalloc(sizeof(struct nft_af_info), GFP_KERNEL); +- if (net->nft.ipv4 == NULL) +- return -ENOMEM; +- +- memcpy(net->nft.ipv4, &nft_af_ipv4, sizeof(nft_af_ipv4)); +- +- if (nft_register_afinfo(net, net->nft.ipv4) < 0) +- goto err; +- +- return 0; +-err: +- kfree(net->nft.ipv4); +- return -ENOMEM; +-} +- +-static void nf_tables_ipv4_exit_net(struct net *net) +-{ +- nft_unregister_afinfo(net, net->nft.ipv4); +- kfree(net->nft.ipv4); +-} +- +-static struct pernet_operations nf_tables_ipv4_net_ops = { +- .init = nf_tables_ipv4_init_net, +- .exit = nf_tables_ipv4_exit_net, +-}; +- + static const struct nf_chain_type filter_ipv4 = { + .name = "filter", + .type = NFT_CHAIN_T_DEFAULT, +@@ -86,21 +58,25 @@ static int __init nf_tables_ipv4_init(vo + { + int ret; + +- ret = nft_register_chain_type(&filter_ipv4); ++ ret = nft_register_afinfo(&nft_af_ipv4); + if (ret < 0) + return ret; + +- ret = register_pernet_subsys(&nf_tables_ipv4_net_ops); ++ ret = nft_register_chain_type(&filter_ipv4); + if (ret < 0) +- nft_unregister_chain_type(&filter_ipv4); ++ goto err_register_chain; ++ ++ return 0; + ++err_register_chain: ++ nft_unregister_afinfo(&nft_af_ipv4); + return ret; + } + + static void __exit nf_tables_ipv4_exit(void) + { +- unregister_pernet_subsys(&nf_tables_ipv4_net_ops); + nft_unregister_chain_type(&filter_ipv4); ++ nft_unregister_afinfo(&nft_af_ipv4); + } + + module_init(nf_tables_ipv4_init); +--- a/net/ipv6/netfilter/nf_tables_ipv6.c ++++ b/net/ipv6/netfilter/nf_tables_ipv6.c +@@ -33,34 +33,6 @@ static struct nft_af_info nft_af_ipv6 __ + .owner = THIS_MODULE, + }; + +-static int nf_tables_ipv6_init_net(struct net *net) +-{ +- net->nft.ipv6 = kmalloc(sizeof(struct nft_af_info), GFP_KERNEL); +- if (net->nft.ipv6 == NULL) +- return -ENOMEM; +- +- memcpy(net->nft.ipv6, &nft_af_ipv6, sizeof(nft_af_ipv6)); +- +- if (nft_register_afinfo(net, net->nft.ipv6) < 0) +- goto err; +- +- return 0; +-err: +- kfree(net->nft.ipv6); +- return -ENOMEM; +-} +- +-static void nf_tables_ipv6_exit_net(struct net *net) +-{ +- nft_unregister_afinfo(net, net->nft.ipv6); +- kfree(net->nft.ipv6); +-} +- +-static struct pernet_operations nf_tables_ipv6_net_ops = { +- .init = nf_tables_ipv6_init_net, +- .exit = nf_tables_ipv6_exit_net, +-}; +- + static const struct nf_chain_type filter_ipv6 = { + .name = "filter", + .type = NFT_CHAIN_T_DEFAULT, +@@ -84,20 +56,24 @@ static int __init nf_tables_ipv6_init(vo + { + int ret; + +- ret = nft_register_chain_type(&filter_ipv6); ++ ret = nft_register_afinfo(&nft_af_ipv6); + if (ret < 0) + return ret; + +- ret = register_pernet_subsys(&nf_tables_ipv6_net_ops); ++ ret = nft_register_chain_type(&filter_ipv6); + if (ret < 0) +- nft_unregister_chain_type(&filter_ipv6); ++ goto err_register_chain; ++ ++ return 0; + ++err_register_chain: ++ nft_unregister_afinfo(&nft_af_ipv6); + return ret; + } + + static void __exit nf_tables_ipv6_exit(void) + { +- unregister_pernet_subsys(&nf_tables_ipv6_net_ops); ++ nft_unregister_afinfo(&nft_af_ipv6); + nft_unregister_chain_type(&filter_ipv6); + } + +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -26,6 +26,7 @@ + static LIST_HEAD(nf_tables_expressions); + static LIST_HEAD(nf_tables_objects); + static LIST_HEAD(nf_tables_flowtables); ++static LIST_HEAD(nf_tables_af_info); + + /** + * nft_register_afinfo - register nf_tables address family info +@@ -35,17 +36,15 @@ static LIST_HEAD(nf_tables_flowtables); + * Register the address family for use with nf_tables. Returns zero on + * success or a negative errno code otherwise. + */ +-int nft_register_afinfo(struct net *net, struct nft_af_info *afi) ++int nft_register_afinfo(struct nft_af_info *afi) + { + nfnl_lock(NFNL_SUBSYS_NFTABLES); +- list_add_tail_rcu(&afi->list, &net->nft.af_info); ++ list_add_tail_rcu(&afi->list, &nf_tables_af_info); + nfnl_unlock(NFNL_SUBSYS_NFTABLES); + return 0; + } + EXPORT_SYMBOL_GPL(nft_register_afinfo); + +-static void __nft_release_afinfo(struct net *net, struct nft_af_info *afi); +- + /** + * nft_unregister_afinfo - unregister nf_tables address family info + * +@@ -53,10 +52,9 @@ static void __nft_release_afinfo(struct + * + * Unregister the address family for use with nf_tables. + */ +-void nft_unregister_afinfo(struct net *net, struct nft_af_info *afi) ++void nft_unregister_afinfo(struct nft_af_info *afi) + { + nfnl_lock(NFNL_SUBSYS_NFTABLES); +- __nft_release_afinfo(net, afi); + list_del_rcu(&afi->list); + nfnl_unlock(NFNL_SUBSYS_NFTABLES); + } +@@ -66,7 +64,7 @@ static struct nft_af_info *nft_afinfo_lo + { + struct nft_af_info *afi; + +- list_for_each_entry(afi, &net->nft.af_info, list) { ++ list_for_each_entry(afi, &nf_tables_af_info, list) { + if (afi->family == family) + return afi; + } +@@ -5036,15 +5034,12 @@ void nft_flow_table_iterate(struct net * + void *data) + { + struct nft_flowtable *flowtable; +- const struct nft_af_info *afi; + const struct nft_table *table; + + rcu_read_lock(); +- list_for_each_entry_rcu(afi, &net->nft.af_info, list) { +- list_for_each_entry_rcu(table, &net->nft.tables, list) { +- list_for_each_entry_rcu(flowtable, &table->flowtables, list) { +- iter(&flowtable->data, data); +- } ++ list_for_each_entry_rcu(table, &net->nft.tables, list) { ++ list_for_each_entry_rcu(flowtable, &table->flowtables, list) { ++ iter(&flowtable->data, data); + } + } + rcu_read_unlock(); +@@ -6536,21 +6531,6 @@ int nft_data_dump(struct sk_buff *skb, i + } + EXPORT_SYMBOL_GPL(nft_data_dump); + +-static int __net_init nf_tables_init_net(struct net *net) +-{ +- INIT_LIST_HEAD(&net->nft.af_info); +- INIT_LIST_HEAD(&net->nft.tables); +- INIT_LIST_HEAD(&net->nft.commit_list); +- net->nft.base_seq = 1; +- return 0; +-} +- +-static void __net_exit nf_tables_exit_net(struct net *net) +-{ +- WARN_ON_ONCE(!list_empty(&net->nft.af_info)); +- WARN_ON_ONCE(!list_empty(&net->nft.commit_list)); +-} +- + int __nft_release_basechain(struct nft_ctx *ctx) + { + struct nft_rule *rule, *nr; +@@ -6571,8 +6551,7 @@ int __nft_release_basechain(struct nft_c + } + EXPORT_SYMBOL_GPL(__nft_release_basechain); + +-/* Called by nft_unregister_afinfo() from __net_exit path, nfnl_lock is held. */ +-static void __nft_release_afinfo(struct net *net, struct nft_af_info *afi) ++static void __nft_release_afinfo(struct net *net) + { + struct nft_flowtable *flowtable, *nf; + struct nft_table *table, *nt; +@@ -6582,10 +6561,11 @@ static void __nft_release_afinfo(struct + struct nft_set *set, *ns; + struct nft_ctx ctx = { + .net = net, +- .family = afi->family, + }; + + list_for_each_entry_safe(table, nt, &net->nft.tables, list) { ++ ctx.family = table->afi->family; ++ + list_for_each_entry(chain, &table->chains, list) + nf_tables_unregister_hook(net, table, chain); + list_for_each_entry(flowtable, &table->flowtables, list) +@@ -6626,6 +6606,21 @@ static void __nft_release_afinfo(struct + } + } + ++static int __net_init nf_tables_init_net(struct net *net) ++{ ++ INIT_LIST_HEAD(&net->nft.tables); ++ INIT_LIST_HEAD(&net->nft.commit_list); ++ net->nft.base_seq = 1; ++ return 0; ++} ++ ++static void __net_exit nf_tables_exit_net(struct net *net) ++{ ++ __nft_release_afinfo(net); ++ WARN_ON_ONCE(!list_empty(&net->nft.tables)); ++ WARN_ON_ONCE(!list_empty(&net->nft.commit_list)); ++} ++ + static struct pernet_operations nf_tables_net_ops = { + .init = nf_tables_init_net, + .exit = nf_tables_exit_net, +--- a/net/netfilter/nf_tables_inet.c ++++ b/net/netfilter/nf_tables_inet.c +@@ -43,34 +43,6 @@ static struct nft_af_info nft_af_inet __ + .owner = THIS_MODULE, + }; + +-static int __net_init nf_tables_inet_init_net(struct net *net) +-{ +- net->nft.inet = kmalloc(sizeof(struct nft_af_info), GFP_KERNEL); +- if (net->nft.inet == NULL) +- return -ENOMEM; +- memcpy(net->nft.inet, &nft_af_inet, sizeof(nft_af_inet)); +- +- if (nft_register_afinfo(net, net->nft.inet) < 0) +- goto err; +- +- return 0; +- +-err: +- kfree(net->nft.inet); +- return -ENOMEM; +-} +- +-static void __net_exit nf_tables_inet_exit_net(struct net *net) +-{ +- nft_unregister_afinfo(net, net->nft.inet); +- kfree(net->nft.inet); +-} +- +-static struct pernet_operations nf_tables_inet_net_ops = { +- .init = nf_tables_inet_init_net, +- .exit = nf_tables_inet_exit_net, +-}; +- + static const struct nf_chain_type filter_inet = { + .name = "filter", + .type = NFT_CHAIN_T_DEFAULT, +@@ -94,21 +66,24 @@ static int __init nf_tables_inet_init(vo + { + int ret; + +- ret = nft_register_chain_type(&filter_inet); +- if (ret < 0) ++ if (nft_register_afinfo(&nft_af_inet) < 0) + return ret; + +- ret = register_pernet_subsys(&nf_tables_inet_net_ops); ++ ret = nft_register_chain_type(&filter_inet); + if (ret < 0) +- nft_unregister_chain_type(&filter_inet); ++ goto err_register_chain; ++ ++ return ret; + ++err_register_chain: ++ nft_unregister_afinfo(&nft_af_inet); + return ret; + } + + static void __exit nf_tables_inet_exit(void) + { +- unregister_pernet_subsys(&nf_tables_inet_net_ops); + nft_unregister_chain_type(&filter_inet); ++ nft_unregister_afinfo(&nft_af_inet); + } + + module_init(nf_tables_inet_init); +--- a/net/netfilter/nf_tables_netdev.c ++++ b/net/netfilter/nf_tables_netdev.c +@@ -43,34 +43,6 @@ static struct nft_af_info nft_af_netdev + .owner = THIS_MODULE, + }; + +-static int nf_tables_netdev_init_net(struct net *net) +-{ +- net->nft.netdev = kmalloc(sizeof(struct nft_af_info), GFP_KERNEL); +- if (net->nft.netdev == NULL) +- return -ENOMEM; +- +- memcpy(net->nft.netdev, &nft_af_netdev, sizeof(nft_af_netdev)); +- +- if (nft_register_afinfo(net, net->nft.netdev) < 0) +- goto err; +- +- return 0; +-err: +- kfree(net->nft.netdev); +- return -ENOMEM; +-} +- +-static void nf_tables_netdev_exit_net(struct net *net) +-{ +- nft_unregister_afinfo(net, net->nft.netdev); +- kfree(net->nft.netdev); +-} +- +-static struct pernet_operations nf_tables_netdev_net_ops = { +- .init = nf_tables_netdev_init_net, +- .exit = nf_tables_netdev_exit_net, +-}; +- + static const struct nf_chain_type nft_filter_chain_netdev = { + .name = "filter", + .type = NFT_CHAIN_T_DEFAULT, +@@ -145,32 +117,32 @@ static int __init nf_tables_netdev_init( + { + int ret; + +- ret = nft_register_chain_type(&nft_filter_chain_netdev); +- if (ret) ++ if (nft_register_afinfo(&nft_af_netdev) < 0) + return ret; + +- ret = register_pernet_subsys(&nf_tables_netdev_net_ops); ++ ret = nft_register_chain_type(&nft_filter_chain_netdev); + if (ret) +- goto err1; ++ goto err_register_chain_type; + + ret = register_netdevice_notifier(&nf_tables_netdev_notifier); + if (ret) +- goto err2; ++ goto err_register_netdevice_notifier; + + return 0; + +-err2: +- unregister_pernet_subsys(&nf_tables_netdev_net_ops); +-err1: ++err_register_netdevice_notifier: + nft_unregister_chain_type(&nft_filter_chain_netdev); ++err_register_chain_type: ++ nft_unregister_afinfo(&nft_af_netdev); ++ + return ret; + } + + static void __exit nf_tables_netdev_exit(void) + { + unregister_netdevice_notifier(&nf_tables_netdev_notifier); +- unregister_pernet_subsys(&nf_tables_netdev_net_ops); + nft_unregister_chain_type(&nft_filter_chain_netdev); ++ nft_unregister_afinfo(&nft_af_netdev); + } + + module_init(nf_tables_netdev_init); diff --git a/target/linux/generic/backport-4.19/338-v4.16-netfilter-nf_tables-get-rid-of-struct-nft_af_info-ab.patch b/target/linux/generic/backport-4.19/338-v4.16-netfilter-nf_tables-get-rid-of-struct-nft_af_info-ab.patch new file mode 100644 index 0000000000..e5ed45c1c6 --- /dev/null +++ b/target/linux/generic/backport-4.19/338-v4.16-netfilter-nf_tables-get-rid-of-struct-nft_af_info-ab.patch @@ -0,0 +1,1204 @@ +From: Pablo Neira Ayuso <pablo@netfilter.org> +Date: Tue, 9 Jan 2018 02:48:47 +0100 +Subject: [PATCH] netfilter: nf_tables: get rid of struct nft_af_info + abstraction + +Remove the infrastructure to register/unregister nft_af_info structure, +this structure stores no useful information anymore. + +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + +--- a/include/net/netfilter/nf_tables.h ++++ b/include/net/netfilter/nf_tables.h +@@ -955,28 +955,12 @@ struct nft_table { + struct list_head flowtables; + u64 hgenerator; + u32 use; +- u16 flags:14, ++ u16 family:6, ++ flags:8, + genmask:2; +- struct nft_af_info *afi; + char *name; + }; + +-/** +- * struct nft_af_info - nf_tables address family info +- * +- * @list: used internally +- * @family: address family +- * @owner: module owner +- */ +-struct nft_af_info { +- struct list_head list; +- int family; +- struct module *owner; +-}; +- +-int nft_register_afinfo(struct nft_af_info *); +-void nft_unregister_afinfo(struct nft_af_info *); +- + int nft_register_chain_type(const struct nf_chain_type *); + void nft_unregister_chain_type(const struct nf_chain_type *); + +@@ -1144,9 +1128,6 @@ void nft_trace_notify(struct nft_tracein + #define nft_dereference(p) \ + nfnl_dereference(p, NFNL_SUBSYS_NFTABLES) + +-#define MODULE_ALIAS_NFT_FAMILY(family) \ +- MODULE_ALIAS("nft-afinfo-" __stringify(family)) +- + #define MODULE_ALIAS_NFT_CHAIN(family, name) \ + MODULE_ALIAS("nft-chain-" __stringify(family) "-" name) + +--- a/net/bridge/netfilter/nf_tables_bridge.c ++++ b/net/bridge/netfilter/nf_tables_bridge.c +@@ -42,11 +42,6 @@ nft_do_chain_bridge(void *priv, + return nft_do_chain(&pkt, priv); + } + +-static struct nft_af_info nft_af_bridge __read_mostly = { +- .family = NFPROTO_BRIDGE, +- .owner = THIS_MODULE, +-}; +- + static const struct nf_chain_type filter_bridge = { + .name = "filter", + .type = NFT_CHAIN_T_DEFAULT, +@@ -68,28 +63,12 @@ static const struct nf_chain_type filter + + static int __init nf_tables_bridge_init(void) + { +- int ret; +- +- ret = nft_register_afinfo(&nft_af_bridge); +- if (ret < 0) +- return ret; +- +- ret = nft_register_chain_type(&filter_bridge); +- if (ret < 0) +- goto err_register_chain; +- +- return ret; +- +-err_register_chain: +- nft_unregister_chain_type(&filter_bridge); +- +- return ret; ++ return nft_register_chain_type(&filter_bridge); + } + + static void __exit nf_tables_bridge_exit(void) + { + nft_unregister_chain_type(&filter_bridge); +- nft_unregister_afinfo(&nft_af_bridge); + } + + module_init(nf_tables_bridge_init); +@@ -97,4 +76,4 @@ module_exit(nf_tables_bridge_exit); + + MODULE_LICENSE("GPL"); + MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>"); +-MODULE_ALIAS_NFT_FAMILY(AF_BRIDGE); ++MODULE_ALIAS_NFT_CHAIN(AF_BRIDGE, "filter"); +--- a/net/ipv4/netfilter/nf_tables_arp.c ++++ b/net/ipv4/netfilter/nf_tables_arp.c +@@ -27,11 +27,6 @@ nft_do_chain_arp(void *priv, + return nft_do_chain(&pkt, priv); + } + +-static struct nft_af_info nft_af_arp __read_mostly = { +- .family = NFPROTO_ARP, +- .owner = THIS_MODULE, +-}; +- + static const struct nf_chain_type filter_arp = { + .name = "filter", + .type = NFT_CHAIN_T_DEFAULT, +@@ -47,28 +42,12 @@ static const struct nf_chain_type filter + + static int __init nf_tables_arp_init(void) + { +- int ret; +- +- ret = nft_register_afinfo(&nft_af_arp); +- if (ret < 0) +- return ret; +- +- ret = nft_register_chain_type(&filter_arp); +- if (ret < 0) +- goto err_register_chain; +- +- return 0; +- +-err_register_chain: +- nft_unregister_chain_type(&filter_arp); +- +- return ret; ++ return nft_register_chain_type(&filter_arp); + } + + static void __exit nf_tables_arp_exit(void) + { + nft_unregister_chain_type(&filter_arp); +- nft_unregister_afinfo(&nft_af_arp); + } + + module_init(nf_tables_arp_init); +@@ -76,4 +55,4 @@ module_exit(nf_tables_arp_exit); + + MODULE_LICENSE("GPL"); + MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>"); +-MODULE_ALIAS_NFT_FAMILY(3); /* NFPROTO_ARP */ ++MODULE_ALIAS_NFT_CHAIN(3, "filter"); /* NFPROTO_ARP */ +--- a/net/ipv4/netfilter/nf_tables_ipv4.c ++++ b/net/ipv4/netfilter/nf_tables_ipv4.c +@@ -30,11 +30,6 @@ static unsigned int nft_do_chain_ipv4(vo + return nft_do_chain(&pkt, priv); + } + +-static struct nft_af_info nft_af_ipv4 __read_mostly = { +- .family = NFPROTO_IPV4, +- .owner = THIS_MODULE, +-}; +- + static const struct nf_chain_type filter_ipv4 = { + .name = "filter", + .type = NFT_CHAIN_T_DEFAULT, +@@ -56,27 +51,12 @@ static const struct nf_chain_type filter + + static int __init nf_tables_ipv4_init(void) + { +- int ret; +- +- ret = nft_register_afinfo(&nft_af_ipv4); +- if (ret < 0) +- return ret; +- +- ret = nft_register_chain_type(&filter_ipv4); +- if (ret < 0) +- goto err_register_chain; +- +- return 0; +- +-err_register_chain: +- nft_unregister_afinfo(&nft_af_ipv4); +- return ret; ++ return nft_register_chain_type(&filter_ipv4); + } + + static void __exit nf_tables_ipv4_exit(void) + { + nft_unregister_chain_type(&filter_ipv4); +- nft_unregister_afinfo(&nft_af_ipv4); + } + + module_init(nf_tables_ipv4_init); +@@ -84,4 +64,4 @@ module_exit(nf_tables_ipv4_exit); + + MODULE_LICENSE("GPL"); + MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>"); +-MODULE_ALIAS_NFT_FAMILY(AF_INET); ++MODULE_ALIAS_NFT_CHAIN(AF_INET, "filter"); +--- a/net/ipv6/netfilter/nf_tables_ipv6.c ++++ b/net/ipv6/netfilter/nf_tables_ipv6.c +@@ -28,11 +28,6 @@ static unsigned int nft_do_chain_ipv6(vo + return nft_do_chain(&pkt, priv); + } + +-static struct nft_af_info nft_af_ipv6 __read_mostly = { +- .family = NFPROTO_IPV6, +- .owner = THIS_MODULE, +-}; +- + static const struct nf_chain_type filter_ipv6 = { + .name = "filter", + .type = NFT_CHAIN_T_DEFAULT, +@@ -54,26 +49,11 @@ static const struct nf_chain_type filter + + static int __init nf_tables_ipv6_init(void) + { +- int ret; +- +- ret = nft_register_afinfo(&nft_af_ipv6); +- if (ret < 0) +- return ret; +- +- ret = nft_register_chain_type(&filter_ipv6); +- if (ret < 0) +- goto err_register_chain; +- +- return 0; +- +-err_register_chain: +- nft_unregister_afinfo(&nft_af_ipv6); +- return ret; ++ return nft_register_chain_type(&filter_ipv6); + } + + static void __exit nf_tables_ipv6_exit(void) + { +- nft_unregister_afinfo(&nft_af_ipv6); + nft_unregister_chain_type(&filter_ipv6); + } + +@@ -82,4 +62,4 @@ module_exit(nf_tables_ipv6_exit); + + MODULE_LICENSE("GPL"); + MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>"); +-MODULE_ALIAS_NFT_FAMILY(AF_INET6); ++MODULE_ALIAS_NFT_CHAIN(AF_INET6, "filter"); +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -26,71 +26,6 @@ + static LIST_HEAD(nf_tables_expressions); + static LIST_HEAD(nf_tables_objects); + static LIST_HEAD(nf_tables_flowtables); +-static LIST_HEAD(nf_tables_af_info); +- +-/** +- * nft_register_afinfo - register nf_tables address family info +- * +- * @afi: address family info to register +- * +- * Register the address family for use with nf_tables. Returns zero on +- * success or a negative errno code otherwise. +- */ +-int nft_register_afinfo(struct nft_af_info *afi) +-{ +- nfnl_lock(NFNL_SUBSYS_NFTABLES); +- list_add_tail_rcu(&afi->list, &nf_tables_af_info); +- nfnl_unlock(NFNL_SUBSYS_NFTABLES); +- return 0; +-} +-EXPORT_SYMBOL_GPL(nft_register_afinfo); +- +-/** +- * nft_unregister_afinfo - unregister nf_tables address family info +- * +- * @afi: address family info to unregister +- * +- * Unregister the address family for use with nf_tables. +- */ +-void nft_unregister_afinfo(struct nft_af_info *afi) +-{ +- nfnl_lock(NFNL_SUBSYS_NFTABLES); +- list_del_rcu(&afi->list); +- nfnl_unlock(NFNL_SUBSYS_NFTABLES); +-} +-EXPORT_SYMBOL_GPL(nft_unregister_afinfo); +- +-static struct nft_af_info *nft_afinfo_lookup(struct net *net, int family) +-{ +- struct nft_af_info *afi; +- +- list_for_each_entry(afi, &nf_tables_af_info, list) { +- if (afi->family == family) +- return afi; +- } +- return NULL; +-} +- +-static struct nft_af_info * +-nf_tables_afinfo_lookup(struct net *net, int family, bool autoload) +-{ +- struct nft_af_info *afi; +- +- afi = nft_afinfo_lookup(net, family); +- if (afi != NULL) +- return afi; +-#ifdef CONFIG_MODULES +- if (autoload) { +- nfnl_unlock(NFNL_SUBSYS_NFTABLES); +- request_module("nft-afinfo-%u", family); +- nfnl_lock(NFNL_SUBSYS_NFTABLES); +- afi = nft_afinfo_lookup(net, family); +- if (afi != NULL) +- return ERR_PTR(-EAGAIN); +- } +-#endif +- return ERR_PTR(-EAFNOSUPPORT); +-} + + static void nft_ctx_init(struct nft_ctx *ctx, + struct net *net, +@@ -419,7 +354,7 @@ static struct nft_table *nft_table_looku + + list_for_each_entry(table, &net->nft.tables, list) { + if (!nla_strcmp(nla, table->name) && +- table->afi->family == family && ++ table->family == family && + nft_active_genmask(table, genmask)) + return table; + } +@@ -560,7 +495,7 @@ static int nf_tables_dump_tables(struct + cb->seq = net->nft.base_seq; + + list_for_each_entry_rcu(table, &net->nft.tables, list) { +- if (family != NFPROTO_UNSPEC && family != table->afi->family) ++ if (family != NFPROTO_UNSPEC && family != table->family) + continue; + + if (idx < s_idx) +@@ -574,7 +509,7 @@ static int nf_tables_dump_tables(struct + NETLINK_CB(cb->skb).portid, + cb->nlh->nlmsg_seq, + NFT_MSG_NEWTABLE, NLM_F_MULTI, +- table->afi->family, table) < 0) ++ table->family, table) < 0) + goto done; + + nl_dump_check_consistent(cb, nlmsg_hdr(skb)); +@@ -594,7 +529,6 @@ static int nf_tables_gettable(struct net + { + const struct nfgenmsg *nfmsg = nlmsg_data(nlh); + u8 genmask = nft_genmask_cur(net); +- const struct nft_af_info *afi; + const struct nft_table *table; + struct sk_buff *skb2; + int family = nfmsg->nfgen_family; +@@ -607,11 +541,7 @@ static int nf_tables_gettable(struct net + return netlink_dump_start(nlsk, skb, nlh, &c); + } + +- afi = nf_tables_afinfo_lookup(net, family, false); +- if (IS_ERR(afi)) +- return PTR_ERR(afi); +- +- table = nf_tables_table_lookup(net, nla[NFTA_TABLE_NAME], afi->family, ++ table = nf_tables_table_lookup(net, nla[NFTA_TABLE_NAME], family, + genmask); + if (IS_ERR(table)) + return PTR_ERR(table); +@@ -731,19 +661,14 @@ static int nf_tables_newtable(struct net + const struct nfgenmsg *nfmsg = nlmsg_data(nlh); + u8 genmask = nft_genmask_next(net); + const struct nlattr *name; +- struct nft_af_info *afi; + struct nft_table *table; + int family = nfmsg->nfgen_family; + u32 flags = 0; + struct nft_ctx ctx; + int err; + +- afi = nf_tables_afinfo_lookup(net, family, true); +- if (IS_ERR(afi)) +- return PTR_ERR(afi); +- + name = nla[NFTA_TABLE_NAME]; +- table = nf_tables_table_lookup(net, name, afi->family, genmask); ++ table = nf_tables_table_lookup(net, name, family, genmask); + if (IS_ERR(table)) { + if (PTR_ERR(table) != -ENOENT) + return PTR_ERR(table); +@@ -753,7 +678,7 @@ static int nf_tables_newtable(struct net + if (nlh->nlmsg_flags & NLM_F_REPLACE) + return -EOPNOTSUPP; + +- nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, NULL, nla); ++ nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla); + return nf_tables_updtable(&ctx); + } + +@@ -763,40 +688,34 @@ static int nf_tables_newtable(struct net + return -EINVAL; + } + +- err = -EAFNOSUPPORT; +- if (!try_module_get(afi->owner)) +- goto err1; +- + err = -ENOMEM; + table = kzalloc(sizeof(*table), GFP_KERNEL); + if (table == NULL) +- goto err2; ++ goto err_kzalloc; + + table->name = nla_strdup(name, GFP_KERNEL); + if (table->name == NULL) +- goto err3; ++ goto err_strdup; + + INIT_LIST_HEAD(&table->chains); + INIT_LIST_HEAD(&table->sets); + INIT_LIST_HEAD(&table->objects); + INIT_LIST_HEAD(&table->flowtables); +- table->afi = afi; ++ table->family = family; + table->flags = flags; + +- nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, NULL, nla); ++ nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla); + err = nft_trans_table_add(&ctx, NFT_MSG_NEWTABLE); + if (err < 0) +- goto err4; ++ goto err_trans; + + list_add_tail_rcu(&table->list, &net->nft.tables); + return 0; +-err4: ++err_trans: + kfree(table->name); +-err3: ++err_strdup: + kfree(table); +-err2: +- module_put(afi->owner); +-err1: ++err_kzalloc: + return err; + } + +@@ -867,10 +786,10 @@ static int nft_flush(struct nft_ctx *ctx + int err = 0; + + list_for_each_entry_safe(table, nt, &ctx->net->nft.tables, list) { +- if (family != AF_UNSPEC && table->afi->family != family) ++ if (family != AF_UNSPEC && table->family != family) + continue; + +- ctx->family = table->afi->family; ++ ctx->family = table->family; + + if (!nft_is_active_next(ctx->net, table)) + continue; +@@ -896,7 +815,6 @@ static int nf_tables_deltable(struct net + { + const struct nfgenmsg *nfmsg = nlmsg_data(nlh); + u8 genmask = nft_genmask_next(net); +- struct nft_af_info *afi; + struct nft_table *table; + int family = nfmsg->nfgen_family; + struct nft_ctx ctx; +@@ -905,11 +823,7 @@ static int nf_tables_deltable(struct net + if (family == AF_UNSPEC || nla[NFTA_TABLE_NAME] == NULL) + return nft_flush(&ctx, family); + +- afi = nf_tables_afinfo_lookup(net, family, false); +- if (IS_ERR(afi)) +- return PTR_ERR(afi); +- +- table = nf_tables_table_lookup(net, nla[NFTA_TABLE_NAME], afi->family, ++ table = nf_tables_table_lookup(net, nla[NFTA_TABLE_NAME], family, + genmask); + if (IS_ERR(table)) + return PTR_ERR(table); +@@ -918,7 +832,7 @@ static int nf_tables_deltable(struct net + table->use > 0) + return -EBUSY; + +- ctx.family = afi->family; ++ ctx.family = family; + ctx.table = table; + + return nft_flush_table(&ctx); +@@ -930,7 +844,6 @@ static void nf_tables_table_destroy(stru + + kfree(ctx->table->name); + kfree(ctx->table); +- module_put(ctx->table->afi->owner); + } + + int nft_register_chain_type(const struct nf_chain_type *ctype) +@@ -1159,7 +1072,7 @@ static int nf_tables_dump_chains(struct + cb->seq = net->nft.base_seq; + + list_for_each_entry_rcu(table, &net->nft.tables, list) { +- if (family != NFPROTO_UNSPEC && family != table->afi->family) ++ if (family != NFPROTO_UNSPEC && family != table->family) + continue; + + list_for_each_entry_rcu(chain, &table->chains, list) { +@@ -1175,7 +1088,7 @@ static int nf_tables_dump_chains(struct + cb->nlh->nlmsg_seq, + NFT_MSG_NEWCHAIN, + NLM_F_MULTI, +- table->afi->family, table, ++ table->family, table, + chain) < 0) + goto done; + +@@ -1197,7 +1110,6 @@ static int nf_tables_getchain(struct net + { + const struct nfgenmsg *nfmsg = nlmsg_data(nlh); + u8 genmask = nft_genmask_cur(net); +- const struct nft_af_info *afi; + const struct nft_table *table; + const struct nft_chain *chain; + struct sk_buff *skb2; +@@ -1211,11 +1123,7 @@ static int nf_tables_getchain(struct net + return netlink_dump_start(nlsk, skb, nlh, &c); + } + +- afi = nf_tables_afinfo_lookup(net, family, false); +- if (IS_ERR(afi)) +- return PTR_ERR(afi); +- +- table = nf_tables_table_lookup(net, nla[NFTA_CHAIN_TABLE], afi->family, ++ table = nf_tables_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, + genmask); + if (IS_ERR(table)) + return PTR_ERR(table); +@@ -1597,7 +1505,6 @@ static int nf_tables_newchain(struct net + const struct nlattr * uninitialized_var(name); + u8 genmask = nft_genmask_next(net); + int family = nfmsg->nfgen_family; +- struct nft_af_info *afi; + struct nft_table *table; + struct nft_chain *chain; + u8 policy = NF_ACCEPT; +@@ -1607,11 +1514,7 @@ static int nf_tables_newchain(struct net + + create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false; + +- afi = nf_tables_afinfo_lookup(net, family, true); +- if (IS_ERR(afi)) +- return PTR_ERR(afi); +- +- table = nf_tables_table_lookup(net, nla[NFTA_CHAIN_TABLE], afi->family, ++ table = nf_tables_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, + genmask); + if (IS_ERR(table)) + return PTR_ERR(table); +@@ -1652,7 +1555,7 @@ static int nf_tables_newchain(struct net + } + } + +- nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, chain, nla); ++ nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla); + + if (chain != NULL) { + if (nlh->nlmsg_flags & NLM_F_EXCL) +@@ -1673,7 +1576,6 @@ static int nf_tables_delchain(struct net + { + const struct nfgenmsg *nfmsg = nlmsg_data(nlh); + u8 genmask = nft_genmask_next(net); +- struct nft_af_info *afi; + struct nft_table *table; + struct nft_chain *chain; + struct nft_rule *rule; +@@ -1682,11 +1584,7 @@ static int nf_tables_delchain(struct net + u32 use; + int err; + +- afi = nf_tables_afinfo_lookup(net, family, false); +- if (IS_ERR(afi)) +- return PTR_ERR(afi); +- +- table = nf_tables_table_lookup(net, nla[NFTA_CHAIN_TABLE], afi->family, ++ table = nf_tables_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, + genmask); + if (IS_ERR(table)) + return PTR_ERR(table); +@@ -1699,7 +1597,7 @@ static int nf_tables_delchain(struct net + chain->use > 0) + return -EBUSY; + +- nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, chain, nla); ++ nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla); + + use = chain->use; + list_for_each_entry(rule, &chain->rules, list) { +@@ -2123,7 +2021,7 @@ static int nf_tables_dump_rules(struct s + cb->seq = net->nft.base_seq; + + list_for_each_entry_rcu(table, &net->nft.tables, list) { +- if (family != NFPROTO_UNSPEC && family != table->afi->family) ++ if (family != NFPROTO_UNSPEC && family != table->family) + continue; + + if (ctx && ctx->table && strcmp(ctx->table, table->name) != 0) +@@ -2146,7 +2044,7 @@ static int nf_tables_dump_rules(struct s + cb->nlh->nlmsg_seq, + NFT_MSG_NEWRULE, + NLM_F_MULTI | NLM_F_APPEND, +- table->afi->family, ++ table->family, + table, chain, rule) < 0) + goto done; + +@@ -2182,7 +2080,6 @@ static int nf_tables_getrule(struct net + { + const struct nfgenmsg *nfmsg = nlmsg_data(nlh); + u8 genmask = nft_genmask_cur(net); +- const struct nft_af_info *afi; + const struct nft_table *table; + const struct nft_chain *chain; + const struct nft_rule *rule; +@@ -2226,11 +2123,7 @@ static int nf_tables_getrule(struct net + return netlink_dump_start(nlsk, skb, nlh, &c); + } + +- afi = nf_tables_afinfo_lookup(net, family, false); +- if (IS_ERR(afi)) +- return PTR_ERR(afi); +- +- table = nf_tables_table_lookup(net, nla[NFTA_RULE_TABLE], afi->family, ++ table = nf_tables_table_lookup(net, nla[NFTA_RULE_TABLE], family, + genmask); + if (IS_ERR(table)) + return PTR_ERR(table); +@@ -2295,7 +2188,7 @@ static int nf_tables_newrule(struct net + { + const struct nfgenmsg *nfmsg = nlmsg_data(nlh); + u8 genmask = nft_genmask_next(net); +- struct nft_af_info *afi; ++ int family = nfmsg->nfgen_family; + struct nft_table *table; + struct nft_chain *chain; + struct nft_rule *rule, *old_rule = NULL; +@@ -2311,11 +2204,7 @@ static int nf_tables_newrule(struct net + + create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false; + +- afi = nf_tables_afinfo_lookup(net, nfmsg->nfgen_family, create); +- if (IS_ERR(afi)) +- return PTR_ERR(afi); +- +- table = nf_tables_table_lookup(net, nla[NFTA_RULE_TABLE], afi->family, ++ table = nf_tables_table_lookup(net, nla[NFTA_RULE_TABLE], family, + genmask); + if (IS_ERR(table)) + return PTR_ERR(table); +@@ -2355,7 +2244,7 @@ static int nf_tables_newrule(struct net + return PTR_ERR(old_rule); + } + +- nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, chain, nla); ++ nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla); + + n = 0; + size = 0; +@@ -2484,18 +2373,13 @@ static int nf_tables_delrule(struct net + { + const struct nfgenmsg *nfmsg = nlmsg_data(nlh); + u8 genmask = nft_genmask_next(net); +- struct nft_af_info *afi; + struct nft_table *table; + struct nft_chain *chain = NULL; + struct nft_rule *rule; + int family = nfmsg->nfgen_family, err = 0; + struct nft_ctx ctx; + +- afi = nf_tables_afinfo_lookup(net, family, false); +- if (IS_ERR(afi)) +- return PTR_ERR(afi); +- +- table = nf_tables_table_lookup(net, nla[NFTA_RULE_TABLE], afi->family, ++ table = nf_tables_table_lookup(net, nla[NFTA_RULE_TABLE], family, + genmask); + if (IS_ERR(table)) + return PTR_ERR(table); +@@ -2507,7 +2391,7 @@ static int nf_tables_delrule(struct net + return PTR_ERR(chain); + } + +- nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, chain, nla); ++ nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla); + + if (chain) { + if (nla[NFTA_RULE_HANDLE]) { +@@ -2692,26 +2576,17 @@ static int nft_ctx_init_from_setattr(str + u8 genmask) + { + const struct nfgenmsg *nfmsg = nlmsg_data(nlh); +- struct nft_af_info *afi = NULL; ++ int family = nfmsg->nfgen_family; + struct nft_table *table = NULL; + +- if (nfmsg->nfgen_family != NFPROTO_UNSPEC) { +- afi = nf_tables_afinfo_lookup(net, nfmsg->nfgen_family, false); +- if (IS_ERR(afi)) +- return PTR_ERR(afi); +- } +- + if (nla[NFTA_SET_TABLE] != NULL) { +- if (afi == NULL) +- return -EAFNOSUPPORT; +- + table = nf_tables_table_lookup(net, nla[NFTA_SET_TABLE], +- afi->family, genmask); ++ family, genmask); + if (IS_ERR(table)) + return PTR_ERR(table); + } + +- nft_ctx_init(ctx, net, skb, nlh, afi->family, table, NULL, nla); ++ nft_ctx_init(ctx, net, skb, nlh, family, table, NULL, nla); + return 0; + } + +@@ -2943,7 +2818,7 @@ static int nf_tables_dump_sets(struct sk + + list_for_each_entry_rcu(table, &net->nft.tables, list) { + if (ctx->family != NFPROTO_UNSPEC && +- ctx->family != table->afi->family) ++ ctx->family != table->family) + continue; + + if (ctx->table && ctx->table != table) +@@ -2964,7 +2839,7 @@ static int nf_tables_dump_sets(struct sk + + ctx_set = *ctx; + ctx_set.table = table; +- ctx_set.family = table->afi->family; ++ ctx_set.family = table->family; + + if (nf_tables_fill_set(skb, &ctx_set, set, + NFT_MSG_NEWSET, +@@ -3076,8 +2951,8 @@ static int nf_tables_newset(struct net * + { + const struct nfgenmsg *nfmsg = nlmsg_data(nlh); + u8 genmask = nft_genmask_next(net); ++ int family = nfmsg->nfgen_family; + const struct nft_set_ops *ops; +- struct nft_af_info *afi; + struct nft_table *table; + struct nft_set *set; + struct nft_ctx ctx; +@@ -3184,16 +3059,12 @@ static int nf_tables_newset(struct net * + + create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false; + +- afi = nf_tables_afinfo_lookup(net, nfmsg->nfgen_family, create); +- if (IS_ERR(afi)) +- return PTR_ERR(afi); +- +- table = nf_tables_table_lookup(net, nla[NFTA_SET_TABLE], afi->family, ++ table = nf_tables_table_lookup(net, nla[NFTA_SET_TABLE], family, + genmask); + if (IS_ERR(table)) + return PTR_ERR(table); + +- nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, NULL, nla); ++ nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla); + + set = nf_tables_set_lookup(table, nla[NFTA_SET_NAME], genmask); + if (IS_ERR(set)) { +@@ -3455,19 +3326,15 @@ static int nft_ctx_init_from_elemattr(st + u8 genmask) + { + const struct nfgenmsg *nfmsg = nlmsg_data(nlh); +- struct nft_af_info *afi; ++ int family = nfmsg->nfgen_family; + struct nft_table *table; + +- afi = nf_tables_afinfo_lookup(net, nfmsg->nfgen_family, false); +- if (IS_ERR(afi)) +- return PTR_ERR(afi); +- + table = nf_tables_table_lookup(net, nla[NFTA_SET_ELEM_LIST_TABLE], +- afi->family, genmask); ++ family, genmask); + if (IS_ERR(table)) + return PTR_ERR(table); + +- nft_ctx_init(ctx, net, skb, nlh, afi->family, table, NULL, nla); ++ nft_ctx_init(ctx, net, skb, nlh, family, table, NULL, nla); + return 0; + } + +@@ -3585,7 +3452,7 @@ static int nf_tables_dump_set(struct sk_ + rcu_read_lock(); + list_for_each_entry_rcu(table, &net->nft.tables, list) { + if (dump_ctx->ctx.family != NFPROTO_UNSPEC && +- dump_ctx->ctx.family != table->afi->family) ++ dump_ctx->ctx.family != table->family) + continue; + + if (table != dump_ctx->ctx.table) +@@ -3615,7 +3482,7 @@ static int nf_tables_dump_set(struct sk_ + goto nla_put_failure; + + nfmsg = nlmsg_data(nlh); +- nfmsg->nfgen_family = table->afi->family; ++ nfmsg->nfgen_family = table->family; + nfmsg->version = NFNETLINK_V0; + nfmsg->res_id = htons(net->nft.base_seq & 0xffff); + +@@ -4495,7 +4362,6 @@ static int nf_tables_newobj(struct net * + const struct nft_object_type *type; + u8 genmask = nft_genmask_next(net); + int family = nfmsg->nfgen_family; +- struct nft_af_info *afi; + struct nft_table *table; + struct nft_object *obj; + struct nft_ctx ctx; +@@ -4507,11 +4373,7 @@ static int nf_tables_newobj(struct net * + !nla[NFTA_OBJ_DATA]) + return -EINVAL; + +- afi = nf_tables_afinfo_lookup(net, family, true); +- if (IS_ERR(afi)) +- return PTR_ERR(afi); +- +- table = nf_tables_table_lookup(net, nla[NFTA_OBJ_TABLE], afi->family, ++ table = nf_tables_table_lookup(net, nla[NFTA_OBJ_TABLE], family, + genmask); + if (IS_ERR(table)) + return PTR_ERR(table); +@@ -4530,7 +4392,7 @@ static int nf_tables_newobj(struct net * + return 0; + } + +- nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, NULL, nla); ++ nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla); + + type = nft_obj_type_get(objtype); + if (IS_ERR(type)) +@@ -4622,7 +4484,7 @@ static int nf_tables_dump_obj(struct sk_ + cb->seq = net->nft.base_seq; + + list_for_each_entry_rcu(table, &net->nft.tables, list) { +- if (family != NFPROTO_UNSPEC && family != table->afi->family) ++ if (family != NFPROTO_UNSPEC && family != table->family) + continue; + + list_for_each_entry_rcu(obj, &table->objects, list) { +@@ -4645,7 +4507,7 @@ static int nf_tables_dump_obj(struct sk_ + cb->nlh->nlmsg_seq, + NFT_MSG_NEWOBJ, + NLM_F_MULTI | NLM_F_APPEND, +- table->afi->family, table, ++ table->family, table, + obj, reset) < 0) + goto done; + +@@ -4703,7 +4565,6 @@ static int nf_tables_getobj(struct net * + const struct nfgenmsg *nfmsg = nlmsg_data(nlh); + u8 genmask = nft_genmask_cur(net); + int family = nfmsg->nfgen_family; +- const struct nft_af_info *afi; + const struct nft_table *table; + struct nft_object *obj; + struct sk_buff *skb2; +@@ -4734,11 +4595,7 @@ static int nf_tables_getobj(struct net * + !nla[NFTA_OBJ_TYPE]) + return -EINVAL; + +- afi = nf_tables_afinfo_lookup(net, family, false); +- if (IS_ERR(afi)) +- return PTR_ERR(afi); +- +- table = nf_tables_table_lookup(net, nla[NFTA_OBJ_TABLE], afi->family, ++ table = nf_tables_table_lookup(net, nla[NFTA_OBJ_TABLE], family, + genmask); + if (IS_ERR(table)) + return PTR_ERR(table); +@@ -4785,7 +4642,6 @@ static int nf_tables_delobj(struct net * + const struct nfgenmsg *nfmsg = nlmsg_data(nlh); + u8 genmask = nft_genmask_next(net); + int family = nfmsg->nfgen_family; +- struct nft_af_info *afi; + struct nft_table *table; + struct nft_object *obj; + struct nft_ctx ctx; +@@ -4795,11 +4651,7 @@ static int nf_tables_delobj(struct net * + !nla[NFTA_OBJ_NAME]) + return -EINVAL; + +- afi = nf_tables_afinfo_lookup(net, family, true); +- if (IS_ERR(afi)) +- return PTR_ERR(afi); +- +- table = nf_tables_table_lookup(net, nla[NFTA_OBJ_TABLE], afi->family, ++ table = nf_tables_table_lookup(net, nla[NFTA_OBJ_TABLE], family, + genmask); + if (IS_ERR(table)) + return PTR_ERR(table); +@@ -4811,7 +4663,7 @@ static int nf_tables_delobj(struct net * + if (obj->use > 0) + return -EBUSY; + +- nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, NULL, nla); ++ nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla); + + return nft_delobj(&ctx, obj); + } +@@ -4996,33 +4848,31 @@ err1: + return err; + } + +-static const struct nf_flowtable_type * +-__nft_flowtable_type_get(const struct nft_af_info *afi) ++static const struct nf_flowtable_type *__nft_flowtable_type_get(u8 family) + { + const struct nf_flowtable_type *type; + + list_for_each_entry(type, &nf_tables_flowtables, list) { +- if (afi->family == type->family) ++ if (family == type->family) + return type; + } + return NULL; + } + +-static const struct nf_flowtable_type * +-nft_flowtable_type_get(const struct nft_af_info *afi) ++static const struct nf_flowtable_type *nft_flowtable_type_get(u8 family) + { + const struct nf_flowtable_type *type; + +- type = __nft_flowtable_type_get(afi); ++ type = __nft_flowtable_type_get(family); + if (type != NULL && try_module_get(type->owner)) + return type; + + #ifdef CONFIG_MODULES + if (type == NULL) { + nfnl_unlock(NFNL_SUBSYS_NFTABLES); +- request_module("nf-flowtable-%u", afi->family); ++ request_module("nf-flowtable-%u", family); + nfnl_lock(NFNL_SUBSYS_NFTABLES); +- if (__nft_flowtable_type_get(afi)) ++ if (__nft_flowtable_type_get(family)) + return ERR_PTR(-EAGAIN); + } + #endif +@@ -5070,7 +4920,6 @@ static int nf_tables_newflowtable(struct + u8 genmask = nft_genmask_next(net); + int family = nfmsg->nfgen_family; + struct nft_flowtable *flowtable; +- struct nft_af_info *afi; + struct nft_table *table; + struct nft_ctx ctx; + int err, i, k; +@@ -5080,12 +4929,8 @@ static int nf_tables_newflowtable(struct + !nla[NFTA_FLOWTABLE_HOOK]) + return -EINVAL; + +- afi = nf_tables_afinfo_lookup(net, family, true); +- if (IS_ERR(afi)) +- return PTR_ERR(afi); +- + table = nf_tables_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], +- afi->family, genmask); ++ family, genmask); + if (IS_ERR(table)) + return PTR_ERR(table); + +@@ -5102,7 +4947,7 @@ static int nf_tables_newflowtable(struct + return 0; + } + +- nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, NULL, nla); ++ nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla); + + flowtable = kzalloc(sizeof(*flowtable), GFP_KERNEL); + if (!flowtable) +@@ -5115,7 +4960,7 @@ static int nf_tables_newflowtable(struct + goto err1; + } + +- type = nft_flowtable_type_get(afi); ++ type = nft_flowtable_type_get(family); + if (IS_ERR(type)) { + err = PTR_ERR(type); + goto err2; +@@ -5175,16 +5020,11 @@ static int nf_tables_delflowtable(struct + u8 genmask = nft_genmask_next(net); + int family = nfmsg->nfgen_family; + struct nft_flowtable *flowtable; +- struct nft_af_info *afi; + struct nft_table *table; + struct nft_ctx ctx; + +- afi = nf_tables_afinfo_lookup(net, family, true); +- if (IS_ERR(afi)) +- return PTR_ERR(afi); +- + table = nf_tables_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], +- afi->family, genmask); ++ family, genmask); + if (IS_ERR(table)) + return PTR_ERR(table); + +@@ -5195,7 +5035,7 @@ static int nf_tables_delflowtable(struct + if (flowtable->use > 0) + return -EBUSY; + +- nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, NULL, nla); ++ nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla); + + return nft_delflowtable(&ctx, flowtable); + } +@@ -5270,7 +5110,7 @@ static int nf_tables_dump_flowtable(stru + cb->seq = net->nft.base_seq; + + list_for_each_entry_rcu(table, &net->nft.tables, list) { +- if (family != NFPROTO_UNSPEC && family != table->afi->family) ++ if (family != NFPROTO_UNSPEC && family != table->family) + continue; + + list_for_each_entry_rcu(flowtable, &table->flowtables, list) { +@@ -5289,7 +5129,7 @@ static int nf_tables_dump_flowtable(stru + cb->nlh->nlmsg_seq, + NFT_MSG_NEWFLOWTABLE, + NLM_F_MULTI | NLM_F_APPEND, +- table->afi->family, flowtable) < 0) ++ table->family, flowtable) < 0) + goto done; + + nl_dump_check_consistent(cb, nlmsg_hdr(skb)); +@@ -5349,7 +5189,6 @@ static int nf_tables_getflowtable(struct + u8 genmask = nft_genmask_cur(net); + int family = nfmsg->nfgen_family; + struct nft_flowtable *flowtable; +- const struct nft_af_info *afi; + const struct nft_table *table; + struct sk_buff *skb2; + int err; +@@ -5375,12 +5214,8 @@ static int nf_tables_getflowtable(struct + if (!nla[NFTA_FLOWTABLE_NAME]) + return -EINVAL; + +- afi = nf_tables_afinfo_lookup(net, family, false); +- if (IS_ERR(afi)) +- return PTR_ERR(afi); +- + table = nf_tables_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], +- afi->family, genmask); ++ family, genmask); + if (IS_ERR(table)) + return PTR_ERR(table); + +@@ -6551,7 +6386,7 @@ int __nft_release_basechain(struct nft_c + } + EXPORT_SYMBOL_GPL(__nft_release_basechain); + +-static void __nft_release_afinfo(struct net *net) ++static void __nft_release_tables(struct net *net) + { + struct nft_flowtable *flowtable, *nf; + struct nft_table *table, *nt; +@@ -6564,7 +6399,7 @@ static void __nft_release_afinfo(struct + }; + + list_for_each_entry_safe(table, nt, &net->nft.tables, list) { +- ctx.family = table->afi->family; ++ ctx.family = table->family; + + list_for_each_entry(chain, &table->chains, list) + nf_tables_unregister_hook(net, table, chain); +@@ -6616,7 +6451,7 @@ static int __net_init nf_tables_init_net + + static void __net_exit nf_tables_exit_net(struct net *net) + { +- __nft_release_afinfo(net); ++ __nft_release_tables(net); + WARN_ON_ONCE(!list_empty(&net->nft.tables)); + WARN_ON_ONCE(!list_empty(&net->nft.commit_list)); + } +--- a/net/netfilter/nf_tables_inet.c ++++ b/net/netfilter/nf_tables_inet.c +@@ -38,11 +38,6 @@ static unsigned int nft_do_chain_inet(vo + return nft_do_chain(&pkt, priv); + } + +-static struct nft_af_info nft_af_inet __read_mostly = { +- .family = NFPROTO_INET, +- .owner = THIS_MODULE, +-}; +- + static const struct nf_chain_type filter_inet = { + .name = "filter", + .type = NFT_CHAIN_T_DEFAULT, +@@ -64,26 +59,12 @@ static const struct nf_chain_type filter + + static int __init nf_tables_inet_init(void) + { +- int ret; +- +- if (nft_register_afinfo(&nft_af_inet) < 0) +- return ret; +- +- ret = nft_register_chain_type(&filter_inet); +- if (ret < 0) +- goto err_register_chain; +- +- return ret; +- +-err_register_chain: +- nft_unregister_afinfo(&nft_af_inet); +- return ret; ++ return nft_register_chain_type(&filter_inet); + } + + static void __exit nf_tables_inet_exit(void) + { + nft_unregister_chain_type(&filter_inet); +- nft_unregister_afinfo(&nft_af_inet); + } + + module_init(nf_tables_inet_init); +@@ -91,4 +72,4 @@ module_exit(nf_tables_inet_exit); + + MODULE_LICENSE("GPL"); + MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>"); +-MODULE_ALIAS_NFT_FAMILY(1); ++MODULE_ALIAS_NFT_CHAIN(1, "filter"); +--- a/net/netfilter/nf_tables_netdev.c ++++ b/net/netfilter/nf_tables_netdev.c +@@ -38,11 +38,6 @@ nft_do_chain_netdev(void *priv, struct s + return nft_do_chain(&pkt, priv); + } + +-static struct nft_af_info nft_af_netdev __read_mostly = { +- .family = NFPROTO_NETDEV, +- .owner = THIS_MODULE, +-}; +- + static const struct nf_chain_type nft_filter_chain_netdev = { + .name = "filter", + .type = NFT_CHAIN_T_DEFAULT, +@@ -91,10 +86,10 @@ static int nf_tables_netdev_event(struct + + nfnl_lock(NFNL_SUBSYS_NFTABLES); + list_for_each_entry(table, &ctx.net->nft.tables, list) { +- if (table->afi->family != NFPROTO_NETDEV) ++ if (table->family != NFPROTO_NETDEV) + continue; + +- ctx.family = table->afi->family; ++ ctx.family = table->family; + ctx.table = table; + list_for_each_entry_safe(chain, nr, &table->chains, list) { + if (!nft_is_base_chain(chain)) +@@ -117,12 +112,9 @@ static int __init nf_tables_netdev_init( + { + int ret; + +- if (nft_register_afinfo(&nft_af_netdev) < 0) +- return ret; +- + ret = nft_register_chain_type(&nft_filter_chain_netdev); + if (ret) +- goto err_register_chain_type; ++ return ret; + + ret = register_netdevice_notifier(&nf_tables_netdev_notifier); + if (ret) +@@ -132,8 +124,6 @@ static int __init nf_tables_netdev_init( + + err_register_netdevice_notifier: + nft_unregister_chain_type(&nft_filter_chain_netdev); +-err_register_chain_type: +- nft_unregister_afinfo(&nft_af_netdev); + + return ret; + } +@@ -142,7 +132,6 @@ static void __exit nf_tables_netdev_exit + { + unregister_netdevice_notifier(&nf_tables_netdev_notifier); + nft_unregister_chain_type(&nft_filter_chain_netdev); +- nft_unregister_afinfo(&nft_af_netdev); + } + + module_init(nf_tables_netdev_init); +@@ -150,4 +139,4 @@ module_exit(nf_tables_netdev_exit); + + MODULE_LICENSE("GPL"); + MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>"); +-MODULE_ALIAS_NFT_FAMILY(5); /* NFPROTO_NETDEV */ ++MODULE_ALIAS_NFT_CHAIN(5, "filter"); /* NFPROTO_NETDEV */ diff --git a/target/linux/generic/backport-4.19/339-v4.16-netfilter-nft_flow_offload-wait-for-garbage-collecto.patch b/target/linux/generic/backport-4.19/339-v4.16-netfilter-nft_flow_offload-wait-for-garbage-collecto.patch new file mode 100644 index 0000000000..4b4206502c --- /dev/null +++ b/target/linux/generic/backport-4.19/339-v4.16-netfilter-nft_flow_offload-wait-for-garbage-collecto.patch @@ -0,0 +1,47 @@ +From: Pablo Neira Ayuso <pablo@netfilter.org> +Date: Thu, 1 Feb 2018 18:49:00 +0100 +Subject: [PATCH] netfilter: nft_flow_offload: wait for garbage collector + to run after cleanup + +If netdevice goes down, then flowtable entries are scheduled to be +removed. Wait for garbage collector to have a chance to run so it can +delete them from the hashtable. + +The flush call might sleep, so hold the nfnl mutex from +nft_flow_table_iterate() instead of rcu read side lock. The use of the +nfnl mutex is also implicitly fixing races between updates via nfnetlink +and netdevice event. + +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -4886,13 +4886,13 @@ void nft_flow_table_iterate(struct net * + struct nft_flowtable *flowtable; + const struct nft_table *table; + +- rcu_read_lock(); +- list_for_each_entry_rcu(table, &net->nft.tables, list) { +- list_for_each_entry_rcu(flowtable, &table->flowtables, list) { ++ nfnl_lock(NFNL_SUBSYS_NFTABLES); ++ list_for_each_entry(table, &net->nft.tables, list) { ++ list_for_each_entry(flowtable, &table->flowtables, list) { + iter(&flowtable->data, data); + } + } +- rcu_read_unlock(); ++ nfnl_unlock(NFNL_SUBSYS_NFTABLES); + } + EXPORT_SYMBOL_GPL(nft_flow_table_iterate); + +--- a/net/netfilter/nft_flow_offload.c ++++ b/net/netfilter/nft_flow_offload.c +@@ -208,6 +208,7 @@ static void nft_flow_offload_iterate_cle + void *data) + { + nf_flow_table_iterate(flowtable, flow_offload_iterate_cleanup, data); ++ flush_delayed_work(&flowtable->gc_work); + } + + static int flow_offload_netdev_event(struct notifier_block *this, diff --git a/target/linux/generic/backport-4.19/340-v4.16-netfilter-nft_flow_offload-no-need-to-flush-entries-.patch b/target/linux/generic/backport-4.19/340-v4.16-netfilter-nft_flow_offload-no-need-to-flush-entries-.patch new file mode 100644 index 0000000000..539550d542 --- /dev/null +++ b/target/linux/generic/backport-4.19/340-v4.16-netfilter-nft_flow_offload-no-need-to-flush-entries-.patch @@ -0,0 +1,29 @@ +From: Pablo Neira Ayuso <pablo@netfilter.org> +Date: Thu, 1 Feb 2018 18:49:01 +0100 +Subject: [PATCH] netfilter: nft_flow_offload: no need to flush entries on + module removal + +nft_flow_offload module removal does not require to flush existing +flowtables, it is valid to remove this module while keeping flowtables +around. + +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + +--- a/net/netfilter/nft_flow_offload.c ++++ b/net/netfilter/nft_flow_offload.c +@@ -247,14 +247,8 @@ register_expr: + + static void __exit nft_flow_offload_module_exit(void) + { +- struct net *net; +- + nft_unregister_expr(&nft_flow_offload_type); + unregister_netdevice_notifier(&flow_offload_netdev_notifier); +- rtnl_lock(); +- for_each_net(net) +- nft_flow_table_iterate(net, nft_flow_offload_iterate_cleanup, NULL); +- rtnl_unlock(); + } + + module_init(nft_flow_offload_module_init); diff --git a/target/linux/generic/backport-4.19/341-v4.16-netfilter-nft_flow_offload-move-flowtable-cleanup-ro.patch b/target/linux/generic/backport-4.19/341-v4.16-netfilter-nft_flow_offload-move-flowtable-cleanup-ro.patch new file mode 100644 index 0000000000..9ee0ad5936 --- /dev/null +++ b/target/linux/generic/backport-4.19/341-v4.16-netfilter-nft_flow_offload-move-flowtable-cleanup-ro.patch @@ -0,0 +1,97 @@ +From: Pablo Neira Ayuso <pablo@netfilter.org> +Date: Tue, 23 Jan 2018 17:46:09 +0100 +Subject: [PATCH] netfilter: nft_flow_offload: move flowtable cleanup + routines to nf_flow_table + +Move the flowtable cleanup routines to nf_flow_table and expose the +nf_flow_table_cleanup() helper function. + +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + +--- a/include/net/netfilter/nf_flow_table.h ++++ b/include/net/netfilter/nf_flow_table.h +@@ -95,6 +95,9 @@ struct flow_offload_tuple_rhash *flow_of + int nf_flow_table_iterate(struct nf_flowtable *flow_table, + void (*iter)(struct flow_offload *flow, void *data), + void *data); ++ ++void nf_flow_table_cleanup(struct net *net, struct net_device *dev); ++ + void nf_flow_offload_work_gc(struct work_struct *work); + extern const struct rhashtable_params nf_flow_offload_rhash_params; + +--- a/net/netfilter/nf_flow_table.c ++++ b/net/netfilter/nf_flow_table.c +@@ -4,6 +4,7 @@ + #include <linux/netfilter.h> + #include <linux/rhashtable.h> + #include <linux/netdevice.h> ++#include <net/netfilter/nf_tables.h> + #include <net/netfilter/nf_flow_table.h> + #include <net/netfilter/nf_conntrack.h> + #include <net/netfilter/nf_conntrack_core.h> +@@ -425,5 +426,28 @@ int nf_flow_dnat_port(const struct flow_ + } + EXPORT_SYMBOL_GPL(nf_flow_dnat_port); + ++static void nf_flow_table_do_cleanup(struct flow_offload *flow, void *data) ++{ ++ struct net_device *dev = data; ++ ++ if (dev && flow->tuplehash[0].tuple.iifidx != dev->ifindex) ++ return; ++ ++ flow_offload_dead(flow); ++} ++ ++static void nf_flow_table_iterate_cleanup(struct nf_flowtable *flowtable, ++ void *data) ++{ ++ nf_flow_table_iterate(flowtable, nf_flow_table_do_cleanup, data); ++ flush_delayed_work(&flowtable->gc_work); ++} ++ ++void nf_flow_table_cleanup(struct net *net, struct net_device *dev) ++{ ++ nft_flow_table_iterate(net, nf_flow_table_iterate_cleanup, dev); ++} ++EXPORT_SYMBOL_GPL(nf_flow_table_cleanup); ++ + MODULE_LICENSE("GPL"); + MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>"); +--- a/net/netfilter/nft_flow_offload.c ++++ b/net/netfilter/nft_flow_offload.c +@@ -194,23 +194,6 @@ static struct nft_expr_type nft_flow_off + .owner = THIS_MODULE, + }; + +-static void flow_offload_iterate_cleanup(struct flow_offload *flow, void *data) +-{ +- struct net_device *dev = data; +- +- if (dev && flow->tuplehash[0].tuple.iifidx != dev->ifindex) +- return; +- +- flow_offload_dead(flow); +-} +- +-static void nft_flow_offload_iterate_cleanup(struct nf_flowtable *flowtable, +- void *data) +-{ +- nf_flow_table_iterate(flowtable, flow_offload_iterate_cleanup, data); +- flush_delayed_work(&flowtable->gc_work); +-} +- + static int flow_offload_netdev_event(struct notifier_block *this, + unsigned long event, void *ptr) + { +@@ -219,7 +202,7 @@ static int flow_offload_netdev_event(str + if (event != NETDEV_DOWN) + return NOTIFY_DONE; + +- nft_flow_table_iterate(dev_net(dev), nft_flow_offload_iterate_cleanup, dev); ++ nf_flow_table_cleanup(dev_net(dev), dev); + + return NOTIFY_DONE; + } diff --git a/target/linux/generic/backport-4.19/342-v4.16-netfilter-nf_tables-fix-flowtable-free.patch b/target/linux/generic/backport-4.19/342-v4.16-netfilter-nf_tables-fix-flowtable-free.patch new file mode 100644 index 0000000000..670d2ca6d4 --- /dev/null +++ b/target/linux/generic/backport-4.19/342-v4.16-netfilter-nf_tables-fix-flowtable-free.patch @@ -0,0 +1,140 @@ +From: Pablo Neira Ayuso <pablo@netfilter.org> +Date: Mon, 5 Feb 2018 21:44:50 +0100 +Subject: [PATCH] netfilter: nf_tables: fix flowtable free + +Every flow_offload entry is added into the table twice. Because of this, +rhashtable_free_and_destroy can't be used, since it would call kfree for +each flow_offload object twice. + +This patch adds a call to nf_flow_table_iterate_cleanup() to schedule +removal of entries, then there is an explicitly invocation of the +garbage collector to clean up resources. + +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + +--- a/include/net/netfilter/nf_flow_table.h ++++ b/include/net/netfilter/nf_flow_table.h +@@ -14,6 +14,7 @@ struct nf_flowtable_type { + struct list_head list; + int family; + void (*gc)(struct work_struct *work); ++ void (*free)(struct nf_flowtable *ft); + const struct rhashtable_params *params; + nf_hookfn *hook; + struct module *owner; +@@ -98,6 +99,7 @@ int nf_flow_table_iterate(struct nf_flow + + void nf_flow_table_cleanup(struct net *net, struct net_device *dev); + ++void nf_flow_table_free(struct nf_flowtable *flow_table); + void nf_flow_offload_work_gc(struct work_struct *work); + extern const struct rhashtable_params nf_flow_offload_rhash_params; + +--- a/net/ipv4/netfilter/nf_flow_table_ipv4.c ++++ b/net/ipv4/netfilter/nf_flow_table_ipv4.c +@@ -260,6 +260,7 @@ static struct nf_flowtable_type flowtabl + .family = NFPROTO_IPV4, + .params = &nf_flow_offload_rhash_params, + .gc = nf_flow_offload_work_gc, ++ .free = nf_flow_table_free, + .hook = nf_flow_offload_ip_hook, + .owner = THIS_MODULE, + }; +--- a/net/ipv6/netfilter/nf_flow_table_ipv6.c ++++ b/net/ipv6/netfilter/nf_flow_table_ipv6.c +@@ -254,6 +254,7 @@ static struct nf_flowtable_type flowtabl + .family = NFPROTO_IPV6, + .params = &nf_flow_offload_rhash_params, + .gc = nf_flow_offload_work_gc, ++ .free = nf_flow_table_free, + .hook = nf_flow_offload_ipv6_hook, + .owner = THIS_MODULE, + }; +--- a/net/netfilter/nf_flow_table.c ++++ b/net/netfilter/nf_flow_table.c +@@ -232,19 +232,16 @@ static inline bool nf_flow_is_dying(cons + return flow->flags & FLOW_OFFLOAD_DYING; + } + +-void nf_flow_offload_work_gc(struct work_struct *work) ++static int nf_flow_offload_gc_step(struct nf_flowtable *flow_table) + { + struct flow_offload_tuple_rhash *tuplehash; +- struct nf_flowtable *flow_table; + struct rhashtable_iter hti; + struct flow_offload *flow; + int err; + +- flow_table = container_of(work, struct nf_flowtable, gc_work.work); +- + err = rhashtable_walk_init(&flow_table->rhashtable, &hti, GFP_KERNEL); + if (err) +- goto schedule; ++ return 0; + + rhashtable_walk_start(&hti); + +@@ -270,7 +267,16 @@ void nf_flow_offload_work_gc(struct work + out: + rhashtable_walk_stop(&hti); + rhashtable_walk_exit(&hti); +-schedule: ++ ++ return 1; ++} ++ ++void nf_flow_offload_work_gc(struct work_struct *work) ++{ ++ struct nf_flowtable *flow_table; ++ ++ flow_table = container_of(work, struct nf_flowtable, gc_work.work); ++ nf_flow_offload_gc_step(flow_table); + queue_delayed_work(system_power_efficient_wq, &flow_table->gc_work, HZ); + } + EXPORT_SYMBOL_GPL(nf_flow_offload_work_gc); +@@ -449,5 +455,12 @@ void nf_flow_table_cleanup(struct net *n + } + EXPORT_SYMBOL_GPL(nf_flow_table_cleanup); + ++void nf_flow_table_free(struct nf_flowtable *flow_table) ++{ ++ nf_flow_table_iterate(flow_table, nf_flow_table_do_cleanup, NULL); ++ WARN_ON(!nf_flow_offload_gc_step(flow_table)); ++} ++EXPORT_SYMBOL_GPL(nf_flow_table_free); ++ + MODULE_LICENSE("GPL"); + MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>"); +--- a/net/netfilter/nf_flow_table_inet.c ++++ b/net/netfilter/nf_flow_table_inet.c +@@ -24,6 +24,7 @@ static struct nf_flowtable_type flowtabl + .family = NFPROTO_INET, + .params = &nf_flow_offload_rhash_params, + .gc = nf_flow_offload_work_gc, ++ .free = nf_flow_table_free, + .hook = nf_flow_offload_inet_hook, + .owner = THIS_MODULE, + }; +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -5271,17 +5271,12 @@ err: + nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS); + } + +-static void nft_flowtable_destroy(void *ptr, void *arg) +-{ +- kfree(ptr); +-} +- + static void nf_tables_flowtable_destroy(struct nft_flowtable *flowtable) + { + cancel_delayed_work_sync(&flowtable->data.gc_work); + kfree(flowtable->name); +- rhashtable_free_and_destroy(&flowtable->data.rhashtable, +- nft_flowtable_destroy, NULL); ++ flowtable->data.type->free(&flowtable->data); ++ rhashtable_destroy(&flowtable->data.rhashtable); + module_put(flowtable->data.type->owner); + } + diff --git a/target/linux/generic/backport-4.19/343-netfilter-nft_flow_offload-handle-netdevice-events-f.patch b/target/linux/generic/backport-4.19/343-netfilter-nft_flow_offload-handle-netdevice-events-f.patch new file mode 100644 index 0000000000..7f35cd7c60 --- /dev/null +++ b/target/linux/generic/backport-4.19/343-netfilter-nft_flow_offload-handle-netdevice-events-f.patch @@ -0,0 +1,96 @@ +From: Pablo Neira Ayuso <pablo@netfilter.org> +Date: Thu, 25 Jan 2018 12:58:55 +0100 +Subject: [PATCH] netfilter: nft_flow_offload: handle netdevice events from + nf_flow_table + +Move the code that deals with device events to the core. + +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + +--- a/net/netfilter/nf_flow_table.c ++++ b/net/netfilter/nf_flow_table.c +@@ -462,5 +462,35 @@ void nf_flow_table_free(struct nf_flowta + } + EXPORT_SYMBOL_GPL(nf_flow_table_free); + ++static int nf_flow_table_netdev_event(struct notifier_block *this, ++ unsigned long event, void *ptr) ++{ ++ struct net_device *dev = netdev_notifier_info_to_dev(ptr); ++ ++ if (event != NETDEV_DOWN) ++ return NOTIFY_DONE; ++ ++ nf_flow_table_cleanup(dev_net(dev), dev); ++ ++ return NOTIFY_DONE; ++} ++ ++static struct notifier_block flow_offload_netdev_notifier = { ++ .notifier_call = nf_flow_table_netdev_event, ++}; ++ ++static int __init nf_flow_table_module_init(void) ++{ ++ return register_netdevice_notifier(&flow_offload_netdev_notifier); ++} ++ ++static void __exit nf_flow_table_module_exit(void) ++{ ++ unregister_netdevice_notifier(&flow_offload_netdev_notifier); ++} ++ ++module_init(nf_flow_table_module_init); ++module_exit(nf_flow_table_module_exit); ++ + MODULE_LICENSE("GPL"); + MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>"); +--- a/net/netfilter/nft_flow_offload.c ++++ b/net/netfilter/nft_flow_offload.c +@@ -194,44 +194,14 @@ static struct nft_expr_type nft_flow_off + .owner = THIS_MODULE, + }; + +-static int flow_offload_netdev_event(struct notifier_block *this, +- unsigned long event, void *ptr) +-{ +- struct net_device *dev = netdev_notifier_info_to_dev(ptr); +- +- if (event != NETDEV_DOWN) +- return NOTIFY_DONE; +- +- nf_flow_table_cleanup(dev_net(dev), dev); +- +- return NOTIFY_DONE; +-} +- +-static struct notifier_block flow_offload_netdev_notifier = { +- .notifier_call = flow_offload_netdev_event, +-}; +- + static int __init nft_flow_offload_module_init(void) + { +- int err; +- +- register_netdevice_notifier(&flow_offload_netdev_notifier); +- +- err = nft_register_expr(&nft_flow_offload_type); +- if (err < 0) +- goto register_expr; +- +- return 0; +- +-register_expr: +- unregister_netdevice_notifier(&flow_offload_netdev_notifier); +- return err; ++ return nft_register_expr(&nft_flow_offload_type); + } + + static void __exit nft_flow_offload_module_exit(void) + { + nft_unregister_expr(&nft_flow_offload_type); +- unregister_netdevice_notifier(&flow_offload_netdev_notifier); + } + + module_init(nft_flow_offload_module_init); diff --git a/target/linux/generic/backport-4.19/344-v4.16-netfilter-nf_tables-allocate-handle-and-delete-objec.patch b/target/linux/generic/backport-4.19/344-v4.16-netfilter-nf_tables-allocate-handle-and-delete-objec.patch new file mode 100644 index 0000000000..98ec5d1b7c --- /dev/null +++ b/target/linux/generic/backport-4.19/344-v4.16-netfilter-nf_tables-allocate-handle-and-delete-objec.patch @@ -0,0 +1,468 @@ +From: Harsha Sharma <harshasharmaiitr@gmail.com> +Date: Wed, 27 Dec 2017 00:59:00 +0530 +Subject: [PATCH] netfilter: nf_tables: allocate handle and delete objects via + handle + +This patch allows deletion of objects via unique handle which can be +listed via '-a' option. + +Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com> +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + +--- a/include/net/netfilter/nf_tables.h ++++ b/include/net/netfilter/nf_tables.h +@@ -370,6 +370,7 @@ void nft_unregister_set(struct nft_set_t + * @list: table set list node + * @bindings: list of set bindings + * @name: name of the set ++ * @handle: unique handle of the set + * @ktype: key type (numeric type defined by userspace, not used in the kernel) + * @dtype: data type (verdict or numeric type defined by userspace) + * @objtype: object type (see NFT_OBJECT_* definitions) +@@ -392,6 +393,7 @@ struct nft_set { + struct list_head list; + struct list_head bindings; + char *name; ++ u64 handle; + u32 ktype; + u32 dtype; + u32 objtype; +@@ -941,6 +943,7 @@ unsigned int nft_do_chain(struct nft_pkt + * @objects: stateful objects in the table + * @flowtables: flow tables in the table + * @hgenerator: handle generator state ++ * @handle: table handle + * @use: number of chain references to this table + * @flags: table flag (see enum nft_table_flags) + * @genmask: generation mask +@@ -954,6 +957,7 @@ struct nft_table { + struct list_head objects; + struct list_head flowtables; + u64 hgenerator; ++ u64 handle; + u32 use; + u16 family:6, + flags:8, +@@ -978,9 +982,9 @@ int nft_verdict_dump(struct sk_buff *skb + * @name: name of this stateful object + * @genmask: generation mask + * @use: number of references to this stateful object +- * @data: object data, layout depends on type ++ * @handle: unique object handle + * @ops: object operations +- * @data: pointer to object data ++ * @data: object data, layout depends on type + */ + struct nft_object { + struct list_head list; +@@ -988,6 +992,7 @@ struct nft_object { + struct nft_table *table; + u32 genmask:2, + use:30; ++ u64 handle; + /* runtime data below here */ + const struct nft_object_ops *ops ____cacheline_aligned; + unsigned char data[] +@@ -1069,6 +1074,7 @@ void nft_unregister_obj(struct nft_objec + * @ops_len: number of hooks in array + * @genmask: generation mask + * @use: number of references to this flow table ++ * @handle: unique object handle + * @data: rhashtable and garbage collector + * @ops: array of hooks + */ +@@ -1081,6 +1087,7 @@ struct nft_flowtable { + int ops_len; + u32 genmask:2, + use:30; ++ u64 handle; + /* runtime data below here */ + struct nf_hook_ops *ops ____cacheline_aligned; + struct nf_flowtable data; +--- a/include/uapi/linux/netfilter/nf_tables.h ++++ b/include/uapi/linux/netfilter/nf_tables.h +@@ -174,6 +174,8 @@ enum nft_table_attributes { + NFTA_TABLE_NAME, + NFTA_TABLE_FLAGS, + NFTA_TABLE_USE, ++ NFTA_TABLE_HANDLE, ++ NFTA_TABLE_PAD, + __NFTA_TABLE_MAX + }; + #define NFTA_TABLE_MAX (__NFTA_TABLE_MAX - 1) +@@ -317,6 +319,7 @@ enum nft_set_desc_attributes { + * @NFTA_SET_GC_INTERVAL: garbage collection interval (NLA_U32) + * @NFTA_SET_USERDATA: user data (NLA_BINARY) + * @NFTA_SET_OBJ_TYPE: stateful object type (NLA_U32: NFT_OBJECT_*) ++ * @NFTA_SET_HANDLE: set handle (NLA_U64) + */ + enum nft_set_attributes { + NFTA_SET_UNSPEC, +@@ -335,6 +338,7 @@ enum nft_set_attributes { + NFTA_SET_USERDATA, + NFTA_SET_PAD, + NFTA_SET_OBJ_TYPE, ++ NFTA_SET_HANDLE, + __NFTA_SET_MAX + }; + #define NFTA_SET_MAX (__NFTA_SET_MAX - 1) +@@ -1314,6 +1318,7 @@ enum nft_ct_helper_attributes { + * @NFTA_OBJ_TYPE: stateful object type (NLA_U32) + * @NFTA_OBJ_DATA: stateful object data (NLA_NESTED) + * @NFTA_OBJ_USE: number of references to this expression (NLA_U32) ++ * @NFTA_OBJ_HANDLE: object handle (NLA_U64) + */ + enum nft_object_attributes { + NFTA_OBJ_UNSPEC, +@@ -1322,6 +1327,8 @@ enum nft_object_attributes { + NFTA_OBJ_TYPE, + NFTA_OBJ_DATA, + NFTA_OBJ_USE, ++ NFTA_OBJ_HANDLE, ++ NFTA_OBJ_PAD, + __NFTA_OBJ_MAX + }; + #define NFTA_OBJ_MAX (__NFTA_OBJ_MAX - 1) +@@ -1333,6 +1340,7 @@ enum nft_object_attributes { + * @NFTA_FLOWTABLE_NAME: name of this flow table (NLA_STRING) + * @NFTA_FLOWTABLE_HOOK: netfilter hook configuration(NLA_U32) + * @NFTA_FLOWTABLE_USE: number of references to this flow table (NLA_U32) ++ * @NFTA_FLOWTABLE_HANDLE: object handle (NLA_U64) + */ + enum nft_flowtable_attributes { + NFTA_FLOWTABLE_UNSPEC, +@@ -1340,6 +1348,8 @@ enum nft_flowtable_attributes { + NFTA_FLOWTABLE_NAME, + NFTA_FLOWTABLE_HOOK, + NFTA_FLOWTABLE_USE, ++ NFTA_FLOWTABLE_HANDLE, ++ NFTA_FLOWTABLE_PAD, + __NFTA_FLOWTABLE_MAX + }; + #define NFTA_FLOWTABLE_MAX (__NFTA_FLOWTABLE_MAX - 1) +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -26,6 +26,7 @@ + static LIST_HEAD(nf_tables_expressions); + static LIST_HEAD(nf_tables_objects); + static LIST_HEAD(nf_tables_flowtables); ++static u64 table_handle; + + static void nft_ctx_init(struct nft_ctx *ctx, + struct net *net, +@@ -361,6 +362,20 @@ static struct nft_table *nft_table_looku + return NULL; + } + ++static struct nft_table *nft_table_lookup_byhandle(const struct net *net, ++ const struct nlattr *nla, ++ u8 genmask) ++{ ++ struct nft_table *table; ++ ++ list_for_each_entry(table, &net->nft.tables, list) { ++ if (be64_to_cpu(nla_get_be64(nla)) == table->handle && ++ nft_active_genmask(table, genmask)) ++ return table; ++ } ++ return NULL; ++} ++ + static struct nft_table *nf_tables_table_lookup(const struct net *net, + const struct nlattr *nla, + u8 family, u8 genmask) +@@ -377,6 +392,22 @@ static struct nft_table *nf_tables_table + return ERR_PTR(-ENOENT); + } + ++static struct nft_table *nf_tables_table_lookup_byhandle(const struct net *net, ++ const struct nlattr *nla, ++ u8 genmask) ++{ ++ struct nft_table *table; ++ ++ if (nla == NULL) ++ return ERR_PTR(-EINVAL); ++ ++ table = nft_table_lookup_byhandle(net, nla, genmask); ++ if (table != NULL) ++ return table; ++ ++ return ERR_PTR(-ENOENT); ++} ++ + static inline u64 nf_tables_alloc_handle(struct nft_table *table) + { + return ++table->hgenerator; +@@ -423,6 +454,7 @@ static const struct nla_policy nft_table + [NFTA_TABLE_NAME] = { .type = NLA_STRING, + .len = NFT_TABLE_MAXNAMELEN - 1 }, + [NFTA_TABLE_FLAGS] = { .type = NLA_U32 }, ++ [NFTA_TABLE_HANDLE] = { .type = NLA_U64 }, + }; + + static int nf_tables_fill_table_info(struct sk_buff *skb, struct net *net, +@@ -444,7 +476,9 @@ static int nf_tables_fill_table_info(str + + if (nla_put_string(skb, NFTA_TABLE_NAME, table->name) || + nla_put_be32(skb, NFTA_TABLE_FLAGS, htonl(table->flags)) || +- nla_put_be32(skb, NFTA_TABLE_USE, htonl(table->use))) ++ nla_put_be32(skb, NFTA_TABLE_USE, htonl(table->use)) || ++ nla_put_be64(skb, NFTA_TABLE_HANDLE, cpu_to_be64(table->handle), ++ NFTA_TABLE_PAD)) + goto nla_put_failure; + + nlmsg_end(skb, nlh); +@@ -703,6 +737,7 @@ static int nf_tables_newtable(struct net + INIT_LIST_HEAD(&table->flowtables); + table->family = family; + table->flags = flags; ++ table->handle = ++table_handle; + + nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla); + err = nft_trans_table_add(&ctx, NFT_MSG_NEWTABLE); +@@ -820,11 +855,18 @@ static int nf_tables_deltable(struct net + struct nft_ctx ctx; + + nft_ctx_init(&ctx, net, skb, nlh, 0, NULL, NULL, nla); +- if (family == AF_UNSPEC || nla[NFTA_TABLE_NAME] == NULL) ++ if (family == AF_UNSPEC || ++ (!nla[NFTA_TABLE_NAME] && !nla[NFTA_TABLE_HANDLE])) + return nft_flush(&ctx, family); + +- table = nf_tables_table_lookup(net, nla[NFTA_TABLE_NAME], family, +- genmask); ++ if (nla[NFTA_TABLE_HANDLE]) ++ table = nf_tables_table_lookup_byhandle(net, ++ nla[NFTA_TABLE_HANDLE], ++ genmask); ++ else ++ table = nf_tables_table_lookup(net, nla[NFTA_TABLE_NAME], ++ family, genmask); ++ + if (IS_ERR(table)) + return PTR_ERR(table); + +@@ -1581,6 +1623,7 @@ static int nf_tables_delchain(struct net + struct nft_rule *rule; + int family = nfmsg->nfgen_family; + struct nft_ctx ctx; ++ u64 handle; + u32 use; + int err; + +@@ -1589,7 +1632,12 @@ static int nf_tables_delchain(struct net + if (IS_ERR(table)) + return PTR_ERR(table); + +- chain = nf_tables_chain_lookup(table, nla[NFTA_CHAIN_NAME], genmask); ++ if (nla[NFTA_CHAIN_HANDLE]) { ++ handle = be64_to_cpu(nla_get_be64(nla[NFTA_CHAIN_HANDLE])); ++ chain = nf_tables_chain_lookup_byhandle(table, handle, genmask); ++ } else { ++ chain = nf_tables_chain_lookup(table, nla[NFTA_CHAIN_NAME], genmask); ++ } + if (IS_ERR(chain)) + return PTR_ERR(chain); + +@@ -2563,6 +2611,7 @@ static const struct nla_policy nft_set_p + [NFTA_SET_USERDATA] = { .type = NLA_BINARY, + .len = NFT_USERDATA_MAXLEN }, + [NFTA_SET_OBJ_TYPE] = { .type = NLA_U32 }, ++ [NFTA_SET_HANDLE] = { .type = NLA_U64 }, + }; + + static const struct nla_policy nft_set_desc_policy[NFTA_SET_DESC_MAX + 1] = { +@@ -2606,6 +2655,22 @@ static struct nft_set *nf_tables_set_loo + return ERR_PTR(-ENOENT); + } + ++static struct nft_set *nf_tables_set_lookup_byhandle(const struct nft_table *table, ++ const struct nlattr *nla, u8 genmask) ++{ ++ struct nft_set *set; ++ ++ if (nla == NULL) ++ return ERR_PTR(-EINVAL); ++ ++ list_for_each_entry(set, &table->sets, list) { ++ if (be64_to_cpu(nla_get_be64(nla)) == set->handle && ++ nft_active_genmask(set, genmask)) ++ return set; ++ } ++ return ERR_PTR(-ENOENT); ++} ++ + static struct nft_set *nf_tables_set_lookup_byid(const struct net *net, + const struct nlattr *nla, + u8 genmask) +@@ -2722,6 +2787,9 @@ static int nf_tables_fill_set(struct sk_ + goto nla_put_failure; + if (nla_put_string(skb, NFTA_SET_NAME, set->name)) + goto nla_put_failure; ++ if (nla_put_be64(skb, NFTA_SET_HANDLE, cpu_to_be64(set->handle), ++ NFTA_SET_PAD)) ++ goto nla_put_failure; + if (set->flags != 0) + if (nla_put_be32(skb, NFTA_SET_FLAGS, htonl(set->flags))) + goto nla_put_failure; +@@ -3130,6 +3198,7 @@ static int nf_tables_newset(struct net * + set->udata = udata; + set->timeout = timeout; + set->gc_int = gc_int; ++ set->handle = nf_tables_alloc_handle(table); + + err = ops->init(set, &desc, nla); + if (err < 0) +@@ -3189,7 +3258,10 @@ static int nf_tables_delset(struct net * + if (err < 0) + return err; + +- set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_NAME], genmask); ++ if (nla[NFTA_SET_HANDLE]) ++ set = nf_tables_set_lookup_byhandle(ctx.table, nla[NFTA_SET_HANDLE], genmask); ++ else ++ set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_NAME], genmask); + if (IS_ERR(set)) + return PTR_ERR(set); + +@@ -4250,6 +4322,21 @@ struct nft_object *nf_tables_obj_lookup( + } + EXPORT_SYMBOL_GPL(nf_tables_obj_lookup); + ++struct nft_object *nf_tables_obj_lookup_byhandle(const struct nft_table *table, ++ const struct nlattr *nla, ++ u32 objtype, u8 genmask) ++{ ++ struct nft_object *obj; ++ ++ list_for_each_entry(obj, &table->objects, list) { ++ if (be64_to_cpu(nla_get_be64(nla)) == obj->handle && ++ objtype == obj->ops->type->type && ++ nft_active_genmask(obj, genmask)) ++ return obj; ++ } ++ return ERR_PTR(-ENOENT); ++} ++ + static const struct nla_policy nft_obj_policy[NFTA_OBJ_MAX + 1] = { + [NFTA_OBJ_TABLE] = { .type = NLA_STRING, + .len = NFT_TABLE_MAXNAMELEN - 1 }, +@@ -4257,6 +4344,7 @@ static const struct nla_policy nft_obj_p + .len = NFT_OBJ_MAXNAMELEN - 1 }, + [NFTA_OBJ_TYPE] = { .type = NLA_U32 }, + [NFTA_OBJ_DATA] = { .type = NLA_NESTED }, ++ [NFTA_OBJ_HANDLE] = { .type = NLA_U64}, + }; + + static struct nft_object *nft_obj_init(const struct nft_ctx *ctx, +@@ -4404,6 +4492,8 @@ static int nf_tables_newobj(struct net * + goto err1; + } + obj->table = table; ++ obj->handle = nf_tables_alloc_handle(table); ++ + obj->name = nla_strdup(nla[NFTA_OBJ_NAME], GFP_KERNEL); + if (!obj->name) { + err = -ENOMEM; +@@ -4450,7 +4540,9 @@ static int nf_tables_fill_obj_info(struc + nla_put_string(skb, NFTA_OBJ_NAME, obj->name) || + nla_put_be32(skb, NFTA_OBJ_TYPE, htonl(obj->ops->type->type)) || + nla_put_be32(skb, NFTA_OBJ_USE, htonl(obj->use)) || +- nft_object_dump(skb, NFTA_OBJ_DATA, obj, reset)) ++ nft_object_dump(skb, NFTA_OBJ_DATA, obj, reset) || ++ nla_put_be64(skb, NFTA_OBJ_HANDLE, cpu_to_be64(obj->handle), ++ NFTA_OBJ_PAD)) + goto nla_put_failure; + + nlmsg_end(skb, nlh); +@@ -4648,7 +4740,7 @@ static int nf_tables_delobj(struct net * + u32 objtype; + + if (!nla[NFTA_OBJ_TYPE] || +- !nla[NFTA_OBJ_NAME]) ++ (!nla[NFTA_OBJ_NAME] && !nla[NFTA_OBJ_HANDLE])) + return -EINVAL; + + table = nf_tables_table_lookup(net, nla[NFTA_OBJ_TABLE], family, +@@ -4657,7 +4749,12 @@ static int nf_tables_delobj(struct net * + return PTR_ERR(table); + + objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE])); +- obj = nf_tables_obj_lookup(table, nla[NFTA_OBJ_NAME], objtype, genmask); ++ if (nla[NFTA_OBJ_HANDLE]) ++ obj = nf_tables_obj_lookup_byhandle(table, nla[NFTA_OBJ_HANDLE], ++ objtype, genmask); ++ else ++ obj = nf_tables_obj_lookup(table, nla[NFTA_OBJ_NAME], ++ objtype, genmask); + if (IS_ERR(obj)) + return PTR_ERR(obj); + if (obj->use > 0) +@@ -4729,6 +4826,7 @@ static const struct nla_policy nft_flowt + [NFTA_FLOWTABLE_NAME] = { .type = NLA_STRING, + .len = NFT_NAME_MAXLEN - 1 }, + [NFTA_FLOWTABLE_HOOK] = { .type = NLA_NESTED }, ++ [NFTA_FLOWTABLE_HANDLE] = { .type = NLA_U64 }, + }; + + struct nft_flowtable *nf_tables_flowtable_lookup(const struct nft_table *table, +@@ -4746,6 +4844,20 @@ struct nft_flowtable *nf_tables_flowtabl + } + EXPORT_SYMBOL_GPL(nf_tables_flowtable_lookup); + ++struct nft_flowtable * ++nf_tables_flowtable_lookup_byhandle(const struct nft_table *table, ++ const struct nlattr *nla, u8 genmask) ++{ ++ struct nft_flowtable *flowtable; ++ ++ list_for_each_entry(flowtable, &table->flowtables, list) { ++ if (be64_to_cpu(nla_get_be64(nla)) == flowtable->handle && ++ nft_active_genmask(flowtable, genmask)) ++ return flowtable; ++ } ++ return ERR_PTR(-ENOENT); ++} ++ + #define NFT_FLOWTABLE_DEVICE_MAX 8 + + static int nf_tables_parse_devices(const struct nft_ctx *ctx, +@@ -4954,6 +5066,8 @@ static int nf_tables_newflowtable(struct + return -ENOMEM; + + flowtable->table = table; ++ flowtable->handle = nf_tables_alloc_handle(table); ++ + flowtable->name = nla_strdup(nla[NFTA_FLOWTABLE_NAME], GFP_KERNEL); + if (!flowtable->name) { + err = -ENOMEM; +@@ -5028,8 +5142,14 @@ static int nf_tables_delflowtable(struct + if (IS_ERR(table)) + return PTR_ERR(table); + +- flowtable = nf_tables_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME], +- genmask); ++ if (nla[NFTA_FLOWTABLE_HANDLE]) ++ flowtable = nf_tables_flowtable_lookup_byhandle(table, ++ nla[NFTA_FLOWTABLE_HANDLE], ++ genmask); ++ else ++ flowtable = nf_tables_flowtable_lookup(table, ++ nla[NFTA_FLOWTABLE_NAME], ++ genmask); + if (IS_ERR(flowtable)) + return PTR_ERR(flowtable); + if (flowtable->use > 0) +@@ -5062,7 +5182,9 @@ static int nf_tables_fill_flowtable_info + + if (nla_put_string(skb, NFTA_FLOWTABLE_TABLE, flowtable->table->name) || + nla_put_string(skb, NFTA_FLOWTABLE_NAME, flowtable->name) || +- nla_put_be32(skb, NFTA_FLOWTABLE_USE, htonl(flowtable->use))) ++ nla_put_be32(skb, NFTA_FLOWTABLE_USE, htonl(flowtable->use)) || ++ nla_put_be64(skb, NFTA_FLOWTABLE_HANDLE, cpu_to_be64(flowtable->handle), ++ NFTA_FLOWTABLE_PAD)) + goto nla_put_failure; + + nest = nla_nest_start(skb, NFTA_FLOWTABLE_HOOK); diff --git a/target/linux/generic/backport-4.19/345-v4.16-netfilter-nf_flow_offload-fix-use-after-free-and-a-r.patch b/target/linux/generic/backport-4.19/345-v4.16-netfilter-nf_flow_offload-fix-use-after-free-and-a-r.patch new file mode 100644 index 0000000000..331f22d19a --- /dev/null +++ b/target/linux/generic/backport-4.19/345-v4.16-netfilter-nf_flow_offload-fix-use-after-free-and-a-r.patch @@ -0,0 +1,95 @@ +From: Felix Fietkau <nbd@nbd.name> +Date: Wed, 7 Feb 2018 09:23:25 +0100 +Subject: [PATCH] netfilter: nf_flow_offload: fix use-after-free and a resource + leak + +flow_offload_del frees the flow, so all associated resource must be +freed before. + +Since the ct entry in struct flow_offload_entry was allocated by +flow_offload_alloc, it should be freed by flow_offload_free to take care +of the error handling path when flow_offload_add fails. + +While at it, make flow_offload_del static, since it should never be +called directly, only from the gc step + +Signed-off-by: Felix Fietkau <nbd@nbd.name> +--- + +--- a/include/net/netfilter/nf_flow_table.h ++++ b/include/net/netfilter/nf_flow_table.h +@@ -90,7 +90,6 @@ struct flow_offload *flow_offload_alloc( + void flow_offload_free(struct flow_offload *flow); + + int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow); +-void flow_offload_del(struct nf_flowtable *flow_table, struct flow_offload *flow); + struct flow_offload_tuple_rhash *flow_offload_lookup(struct nf_flowtable *flow_table, + struct flow_offload_tuple *tuple); + int nf_flow_table_iterate(struct nf_flowtable *flow_table, +--- a/net/netfilter/nf_flow_table.c ++++ b/net/netfilter/nf_flow_table.c +@@ -125,7 +125,9 @@ void flow_offload_free(struct flow_offlo + dst_release(flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_cache); + dst_release(flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_cache); + e = container_of(flow, struct flow_offload_entry, flow); +- kfree(e); ++ nf_ct_delete(e->ct, 0, 0); ++ nf_ct_put(e->ct); ++ kfree_rcu(e, rcu_head); + } + EXPORT_SYMBOL_GPL(flow_offload_free); + +@@ -149,11 +151,9 @@ int flow_offload_add(struct nf_flowtable + } + EXPORT_SYMBOL_GPL(flow_offload_add); + +-void flow_offload_del(struct nf_flowtable *flow_table, +- struct flow_offload *flow) ++static void flow_offload_del(struct nf_flowtable *flow_table, ++ struct flow_offload *flow) + { +- struct flow_offload_entry *e; +- + rhashtable_remove_fast(&flow_table->rhashtable, + &flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].node, + *flow_table->type->params); +@@ -161,10 +161,8 @@ void flow_offload_del(struct nf_flowtabl + &flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].node, + *flow_table->type->params); + +- e = container_of(flow, struct flow_offload_entry, flow); +- kfree_rcu(e, rcu_head); ++ flow_offload_free(flow); + } +-EXPORT_SYMBOL_GPL(flow_offload_del); + + struct flow_offload_tuple_rhash * + flow_offload_lookup(struct nf_flowtable *flow_table, +@@ -175,15 +173,6 @@ flow_offload_lookup(struct nf_flowtable + } + EXPORT_SYMBOL_GPL(flow_offload_lookup); + +-static void nf_flow_release_ct(const struct flow_offload *flow) +-{ +- struct flow_offload_entry *e; +- +- e = container_of(flow, struct flow_offload_entry, flow); +- nf_ct_delete(e->ct, 0, 0); +- nf_ct_put(e->ct); +-} +- + int nf_flow_table_iterate(struct nf_flowtable *flow_table, + void (*iter)(struct flow_offload *flow, void *data), + void *data) +@@ -259,10 +248,8 @@ static int nf_flow_offload_gc_step(struc + flow = container_of(tuplehash, struct flow_offload, tuplehash[0]); + + if (nf_flow_has_expired(flow) || +- nf_flow_is_dying(flow)) { ++ nf_flow_is_dying(flow)) + flow_offload_del(flow_table, flow); +- nf_flow_release_ct(flow); +- } + } + out: + rhashtable_walk_stop(&hti); diff --git a/target/linux/generic/backport-4.19/346-v4.16-netfilter-flowtable-infrastructure-depends-on-NETFIL.patch b/target/linux/generic/backport-4.19/346-v4.16-netfilter-flowtable-infrastructure-depends-on-NETFIL.patch new file mode 100644 index 0000000000..bb8c2d3e5a --- /dev/null +++ b/target/linux/generic/backport-4.19/346-v4.16-netfilter-flowtable-infrastructure-depends-on-NETFIL.patch @@ -0,0 +1,73 @@ +From: Pablo Neira Ayuso <pablo@netfilter.org> +Date: Wed, 31 Jan 2018 18:13:39 +0100 +Subject: [PATCH] netfilter: flowtable infrastructure depends on + NETFILTER_INGRESS + +config NF_FLOW_TABLE depends on NETFILTER_INGRESS. If users forget to +enable this toggle, flowtable registration fails with EOPNOTSUPP. + +Moreover, turn 'select NF_FLOW_TABLE' in every flowtable family flavour +into dependency instead, otherwise this new dependency on +NETFILTER_INGRESS causes a warning. This also allows us to remove the +explicit dependency between family flowtables <-> NF_TABLES and +NF_CONNTRACK, given they depend on the NF_FLOW_TABLE core that already +expresses the general dependencies for this new infrastructure. + +Moreover, NF_FLOW_TABLE_INET depends on NF_FLOW_TABLE_IPV4 and +NF_FLOWTABLE_IPV6, which already depends on NF_FLOW_TABLE. So we can get +rid of direct dependency with NF_FLOW_TABLE. + +In general, let's avoid 'select', it just makes things more complicated. + +Reported-by: John Crispin <john@phrozen.org> +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + +--- a/net/ipv4/netfilter/Kconfig ++++ b/net/ipv4/netfilter/Kconfig +@@ -80,8 +80,7 @@ endif # NF_TABLES + + config NF_FLOW_TABLE_IPV4 + tristate "Netfilter flow table IPv4 module" +- depends on NF_CONNTRACK && NF_TABLES +- select NF_FLOW_TABLE ++ depends on NF_FLOW_TABLE + help + This option adds the flow table IPv4 support. + +--- a/net/ipv6/netfilter/Kconfig ++++ b/net/ipv6/netfilter/Kconfig +@@ -101,8 +101,7 @@ endif # NF_TABLES + + config NF_FLOW_TABLE_IPV6 + tristate "Netfilter flow table IPv6 module" +- depends on NF_CONNTRACK && NF_TABLES +- select NF_FLOW_TABLE ++ depends on NF_FLOW_TABLE + help + This option adds the flow table IPv6 support. + +--- a/net/netfilter/Kconfig ++++ b/net/netfilter/Kconfig +@@ -676,8 +676,8 @@ endif # NF_TABLES + + config NF_FLOW_TABLE_INET + tristate "Netfilter flow table mixed IPv4/IPv6 module" +- depends on NF_FLOW_TABLE_IPV4 && NF_FLOW_TABLE_IPV6 +- select NF_FLOW_TABLE ++ depends on NF_FLOW_TABLE_IPV4 ++ depends on NF_FLOW_TABLE_IPV6 + help + This option adds the flow table mixed IPv4/IPv6 support. + +@@ -685,7 +685,9 @@ config NF_FLOW_TABLE_INET + + config NF_FLOW_TABLE + tristate "Netfilter flow table module" +- depends on NF_CONNTRACK && NF_TABLES ++ depends on NETFILTER_INGRESS ++ depends on NF_CONNTRACK ++ depends on NF_TABLES + help + This option adds the flow table core infrastructure. + diff --git a/target/linux/generic/backport-4.19/347-v4.16-netfilter-remove-duplicated-include.patch b/target/linux/generic/backport-4.19/347-v4.16-netfilter-remove-duplicated-include.patch new file mode 100644 index 0000000000..c8a0972725 --- /dev/null +++ b/target/linux/generic/backport-4.19/347-v4.16-netfilter-remove-duplicated-include.patch @@ -0,0 +1,29 @@ +From: Wei Yongjun <weiyongjun1@huawei.com> +Date: Wed, 10 Jan 2018 13:06:46 +0000 +Subject: [PATCH] netfilter: remove duplicated include + +Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com> +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + +--- a/net/ipv6/netfilter/nf_flow_table_ipv6.c ++++ b/net/ipv6/netfilter/nf_flow_table_ipv6.c +@@ -5,7 +5,6 @@ + #include <linux/rhashtable.h> + #include <linux/ipv6.h> + #include <linux/netdevice.h> +-#include <linux/ipv6.h> + #include <net/ipv6.h> + #include <net/ip6_route.h> + #include <net/neighbour.h> +--- a/net/netfilter/nf_queue.c ++++ b/net/netfilter/nf_queue.c +@@ -15,8 +15,6 @@ + #include <linux/netfilter_bridge.h> + #include <linux/seq_file.h> + #include <linux/rcupdate.h> +-#include <linux/netfilter_ipv4.h> +-#include <linux/netfilter_ipv6.h> + #include <net/protocol.h> + #include <net/netfilter/nf_queue.h> + #include <net/dst.h> diff --git a/target/linux/generic/backport-4.19/348-v4.18-netfilter-nf_flow_table-use-IP_CT_DIR_-values-for-FL.patch b/target/linux/generic/backport-4.19/348-v4.18-netfilter-nf_flow_table-use-IP_CT_DIR_-values-for-FL.patch new file mode 100644 index 0000000000..382b33c078 --- /dev/null +++ b/target/linux/generic/backport-4.19/348-v4.18-netfilter-nf_flow_table-use-IP_CT_DIR_-values-for-FL.patch @@ -0,0 +1,35 @@ +From: Felix Fietkau <nbd@nbd.name> +Date: Fri, 16 Feb 2018 09:41:18 +0100 +Subject: [PATCH] netfilter: nf_flow_table: use IP_CT_DIR_* values for + FLOW_OFFLOAD_DIR_* + +Simplifies further code cleanups + +Signed-off-by: Felix Fietkau <nbd@nbd.name> +--- + +--- a/include/net/netfilter/nf_flow_table.h ++++ b/include/net/netfilter/nf_flow_table.h +@@ -6,6 +6,7 @@ + #include <linux/netdevice.h> + #include <linux/rhashtable.h> + #include <linux/rcupdate.h> ++#include <linux/netfilter/nf_conntrack_tuple_common.h> + #include <net/dst.h> + + struct nf_flowtable; +@@ -27,11 +28,10 @@ struct nf_flowtable { + }; + + enum flow_offload_tuple_dir { +- FLOW_OFFLOAD_DIR_ORIGINAL, +- FLOW_OFFLOAD_DIR_REPLY, +- __FLOW_OFFLOAD_DIR_MAX = FLOW_OFFLOAD_DIR_REPLY, ++ FLOW_OFFLOAD_DIR_ORIGINAL = IP_CT_DIR_ORIGINAL, ++ FLOW_OFFLOAD_DIR_REPLY = IP_CT_DIR_REPLY, ++ FLOW_OFFLOAD_DIR_MAX = IP_CT_DIR_MAX + }; +-#define FLOW_OFFLOAD_DIR_MAX (__FLOW_OFFLOAD_DIR_MAX + 1) + + struct flow_offload_tuple { + union { diff --git a/target/linux/generic/backport-4.19/349-v4.18-netfilter-nf_flow_table-clean-up-flow_offload_alloc.patch b/target/linux/generic/backport-4.19/349-v4.18-netfilter-nf_flow_table-clean-up-flow_offload_alloc.patch new file mode 100644 index 0000000000..39ea757f04 --- /dev/null +++ b/target/linux/generic/backport-4.19/349-v4.18-netfilter-nf_flow_table-clean-up-flow_offload_alloc.patch @@ -0,0 +1,118 @@ +From: Felix Fietkau <nbd@nbd.name> +Date: Fri, 16 Feb 2018 09:42:32 +0100 +Subject: [PATCH] netfilter: nf_flow_table: clean up flow_offload_alloc + +Reduce code duplication and make it much easier to read + +Signed-off-by: Felix Fietkau <nbd@nbd.name> +--- + +--- a/net/netfilter/nf_flow_table.c ++++ b/net/netfilter/nf_flow_table.c +@@ -16,6 +16,38 @@ struct flow_offload_entry { + struct rcu_head rcu_head; + }; + ++static void ++flow_offload_fill_dir(struct flow_offload *flow, struct nf_conn *ct, ++ struct nf_flow_route *route, ++ enum flow_offload_tuple_dir dir) ++{ ++ struct flow_offload_tuple *ft = &flow->tuplehash[dir].tuple; ++ struct nf_conntrack_tuple *ctt = &ct->tuplehash[dir].tuple; ++ ++ ft->dir = dir; ++ ++ switch (ctt->src.l3num) { ++ case NFPROTO_IPV4: ++ ft->src_v4 = ctt->src.u3.in; ++ ft->dst_v4 = ctt->dst.u3.in; ++ break; ++ case NFPROTO_IPV6: ++ ft->src_v6 = ctt->src.u3.in6; ++ ft->dst_v6 = ctt->dst.u3.in6; ++ break; ++ } ++ ++ ft->l3proto = ctt->src.l3num; ++ ft->l4proto = ctt->dst.protonum; ++ ft->src_port = ctt->src.u.tcp.port; ++ ft->dst_port = ctt->dst.u.tcp.port; ++ ++ ft->iifidx = route->tuple[dir].ifindex; ++ ft->oifidx = route->tuple[!dir].ifindex; ++ ++ ft->dst_cache = route->tuple[dir].dst; ++} ++ + struct flow_offload * + flow_offload_alloc(struct nf_conn *ct, struct nf_flow_route *route) + { +@@ -40,65 +72,8 @@ flow_offload_alloc(struct nf_conn *ct, s + + entry->ct = ct; + +- switch (ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num) { +- case NFPROTO_IPV4: +- flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_v4 = +- ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3.in; +- flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_v4 = +- ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u3.in; +- flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_v4 = +- ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3.in; +- flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_v4 = +- ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3.in; +- break; +- case NFPROTO_IPV6: +- flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_v6 = +- ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3.in6; +- flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_v6 = +- ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u3.in6; +- flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_v6 = +- ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3.in6; +- flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_v6 = +- ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3.in6; +- break; +- } +- +- flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.l3proto = +- ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num; +- flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.l4proto = +- ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum; +- flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.l3proto = +- ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num; +- flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.l4proto = +- ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum; +- +- flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_cache = +- route->tuple[FLOW_OFFLOAD_DIR_ORIGINAL].dst; +- flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_cache = +- route->tuple[FLOW_OFFLOAD_DIR_REPLY].dst; +- +- flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_port = +- ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u.tcp.port; +- flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_port = +- ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u.tcp.port; +- flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_port = +- ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u.tcp.port; +- flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_port = +- ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u.tcp.port; +- +- flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dir = +- FLOW_OFFLOAD_DIR_ORIGINAL; +- flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dir = +- FLOW_OFFLOAD_DIR_REPLY; +- +- flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.iifidx = +- route->tuple[FLOW_OFFLOAD_DIR_ORIGINAL].ifindex; +- flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.oifidx = +- route->tuple[FLOW_OFFLOAD_DIR_REPLY].ifindex; +- flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.iifidx = +- route->tuple[FLOW_OFFLOAD_DIR_REPLY].ifindex; +- flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.oifidx = +- route->tuple[FLOW_OFFLOAD_DIR_ORIGINAL].ifindex; ++ flow_offload_fill_dir(flow, ct, route, FLOW_OFFLOAD_DIR_ORIGINAL); ++ flow_offload_fill_dir(flow, ct, route, FLOW_OFFLOAD_DIR_REPLY); + + if (ct->status & IPS_SRC_NAT) + flow->flags |= FLOW_OFFLOAD_SNAT; diff --git a/target/linux/generic/backport-4.19/350-v4.18-ipv6-make-ip6_dst_mtu_forward-inline.patch b/target/linux/generic/backport-4.19/350-v4.18-ipv6-make-ip6_dst_mtu_forward-inline.patch new file mode 100644 index 0000000000..daa4d3b3d8 --- /dev/null +++ b/target/linux/generic/backport-4.19/350-v4.18-ipv6-make-ip6_dst_mtu_forward-inline.patch @@ -0,0 +1,80 @@ +From: Felix Fietkau <nbd@nbd.name> +Date: Fri, 16 Feb 2018 10:54:24 +0100 +Subject: [PATCH] ipv6: make ip6_dst_mtu_forward inline + +Removes a direct dependency on ipv6.ko + +Signed-off-by: Felix Fietkau <nbd@nbd.name> +--- + +--- a/include/net/ip6_route.h ++++ b/include/net/ip6_route.h +@@ -252,4 +252,26 @@ static inline bool rt6_duplicate_nexthop + ipv6_addr_equal(&a->rt6i_gateway, &b->rt6i_gateway) && + !lwtunnel_cmp_encap(a->dst.lwtstate, b->dst.lwtstate); + } ++ ++static inline unsigned int ip6_dst_mtu_forward(const struct dst_entry *dst) ++{ ++ unsigned int mtu; ++ struct inet6_dev *idev; ++ ++ if (dst_metric_locked(dst, RTAX_MTU)) { ++ mtu = dst_metric_raw(dst, RTAX_MTU); ++ if (mtu) ++ return mtu; ++ } ++ ++ mtu = IPV6_MIN_MTU; ++ rcu_read_lock(); ++ idev = __in6_dev_get(dst->dev); ++ if (idev) ++ mtu = idev->cnf.mtu6; ++ rcu_read_unlock(); ++ ++ return mtu; ++} ++ + #endif +--- a/include/net/ipv6.h ++++ b/include/net/ipv6.h +@@ -889,8 +889,6 @@ static inline struct sk_buff *ip6_finish + &inet6_sk(sk)->cork); + } + +-unsigned int ip6_dst_mtu_forward(const struct dst_entry *dst); +- + int ip6_dst_lookup(struct net *net, struct sock *sk, struct dst_entry **dst, + struct flowi6 *fl6); + struct dst_entry *ip6_dst_lookup_flow(const struct sock *sk, struct flowi6 *fl6, +--- a/net/ipv6/ip6_output.c ++++ b/net/ipv6/ip6_output.c +@@ -381,28 +381,6 @@ static inline int ip6_forward_finish(str + return dst_output(net, sk, skb); + } + +-unsigned int ip6_dst_mtu_forward(const struct dst_entry *dst) +-{ +- unsigned int mtu; +- struct inet6_dev *idev; +- +- if (dst_metric_locked(dst, RTAX_MTU)) { +- mtu = dst_metric_raw(dst, RTAX_MTU); +- if (mtu) +- return mtu; +- } +- +- mtu = IPV6_MIN_MTU; +- rcu_read_lock(); +- idev = __in6_dev_get(dst->dev); +- if (idev) +- mtu = idev->cnf.mtu6; +- rcu_read_unlock(); +- +- return mtu; +-} +-EXPORT_SYMBOL_GPL(ip6_dst_mtu_forward); +- + static bool ip6_pkt_too_big(const struct sk_buff *skb, unsigned int mtu) + { + if (skb->len <= mtu) diff --git a/target/linux/generic/backport-4.19/351-v4.18-netfilter-nf_flow_table-cache-mtu-in-struct-flow_off.patch b/target/linux/generic/backport-4.19/351-v4.18-netfilter-nf_flow_table-cache-mtu-in-struct-flow_off.patch new file mode 100644 index 0000000000..e2015e72ac --- /dev/null +++ b/target/linux/generic/backport-4.19/351-v4.18-netfilter-nf_flow_table-cache-mtu-in-struct-flow_off.patch @@ -0,0 +1,145 @@ +From: Felix Fietkau <nbd@nbd.name> +Date: Fri, 16 Feb 2018 10:57:23 +0100 +Subject: [PATCH] netfilter: nf_flow_table: cache mtu in struct + flow_offload_tuple + +Reduces the number of cache lines touched in the offload forwarding path + +Signed-off-by: Felix Fietkau <nbd@nbd.name> +--- + +--- a/include/net/netfilter/nf_flow_table.h ++++ b/include/net/netfilter/nf_flow_table.h +@@ -55,6 +55,8 @@ struct flow_offload_tuple { + + int oifidx; + ++ u16 mtu; ++ + struct dst_entry *dst_cache; + }; + +--- a/net/ipv4/netfilter/nf_flow_table_ipv4.c ++++ b/net/ipv4/netfilter/nf_flow_table_ipv4.c +@@ -177,7 +177,7 @@ static int nf_flow_tuple_ip(struct sk_bu + } + + /* Based on ip_exceeds_mtu(). */ +-static bool __nf_flow_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu) ++static bool nf_flow_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu) + { + if (skb->len <= mtu) + return false; +@@ -191,17 +191,6 @@ static bool __nf_flow_exceeds_mtu(const + return true; + } + +-static bool nf_flow_exceeds_mtu(struct sk_buff *skb, const struct rtable *rt) +-{ +- u32 mtu; +- +- mtu = ip_dst_mtu_maybe_forward(&rt->dst, true); +- if (__nf_flow_exceeds_mtu(skb, mtu)) +- return true; +- +- return false; +-} +- + unsigned int + nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb, + const struct nf_hook_state *state) +@@ -232,9 +221,9 @@ nf_flow_offload_ip_hook(void *priv, stru + + dir = tuplehash->tuple.dir; + flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]); +- + rt = (const struct rtable *)flow->tuplehash[dir].tuple.dst_cache; +- if (unlikely(nf_flow_exceeds_mtu(skb, rt))) ++ ++ if (unlikely(nf_flow_exceeds_mtu(skb, flow->tuplehash[dir].tuple.mtu))) + return NF_ACCEPT; + + if (skb_try_make_writable(skb, sizeof(*iph))) +--- a/net/ipv6/netfilter/nf_flow_table_ipv6.c ++++ b/net/ipv6/netfilter/nf_flow_table_ipv6.c +@@ -173,7 +173,7 @@ static int nf_flow_tuple_ipv6(struct sk_ + } + + /* Based on ip_exceeds_mtu(). */ +-static bool __nf_flow_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu) ++static bool nf_flow_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu) + { + if (skb->len <= mtu) + return false; +@@ -184,17 +184,6 @@ static bool __nf_flow_exceeds_mtu(const + return true; + } + +-static bool nf_flow_exceeds_mtu(struct sk_buff *skb, const struct rt6_info *rt) +-{ +- u32 mtu; +- +- mtu = ip6_dst_mtu_forward(&rt->dst); +- if (__nf_flow_exceeds_mtu(skb, mtu)) +- return true; +- +- return false; +-} +- + unsigned int + nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb, + const struct nf_hook_state *state) +@@ -225,9 +214,9 @@ nf_flow_offload_ipv6_hook(void *priv, st + + dir = tuplehash->tuple.dir; + flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]); +- + rt = (struct rt6_info *)flow->tuplehash[dir].tuple.dst_cache; +- if (unlikely(nf_flow_exceeds_mtu(skb, rt))) ++ ++ if (unlikely(nf_flow_exceeds_mtu(skb, flow->tuplehash[dir].tuple.mtu))) + return NF_ACCEPT; + + if (skb_try_make_writable(skb, sizeof(*ip6h))) +--- a/net/netfilter/nf_flow_table.c ++++ b/net/netfilter/nf_flow_table.c +@@ -4,6 +4,8 @@ + #include <linux/netfilter.h> + #include <linux/rhashtable.h> + #include <linux/netdevice.h> ++#include <net/ip.h> ++#include <net/ip6_route.h> + #include <net/netfilter/nf_tables.h> + #include <net/netfilter/nf_flow_table.h> + #include <net/netfilter/nf_conntrack.h> +@@ -23,6 +25,7 @@ flow_offload_fill_dir(struct flow_offloa + { + struct flow_offload_tuple *ft = &flow->tuplehash[dir].tuple; + struct nf_conntrack_tuple *ctt = &ct->tuplehash[dir].tuple; ++ struct dst_entry *dst = route->tuple[dir].dst; + + ft->dir = dir; + +@@ -30,10 +33,12 @@ flow_offload_fill_dir(struct flow_offloa + case NFPROTO_IPV4: + ft->src_v4 = ctt->src.u3.in; + ft->dst_v4 = ctt->dst.u3.in; ++ ft->mtu = ip_dst_mtu_maybe_forward(dst, true); + break; + case NFPROTO_IPV6: + ft->src_v6 = ctt->src.u3.in6; + ft->dst_v6 = ctt->dst.u3.in6; ++ ft->mtu = ip6_dst_mtu_forward(dst); + break; + } + +@@ -44,8 +49,7 @@ flow_offload_fill_dir(struct flow_offloa + + ft->iifidx = route->tuple[dir].ifindex; + ft->oifidx = route->tuple[!dir].ifindex; +- +- ft->dst_cache = route->tuple[dir].dst; ++ ft->dst_cache = dst; + } + + struct flow_offload * diff --git a/target/linux/generic/backport-4.19/352-v4.18-netfilter-nf_flow_table-rename-nf_flow_table.c-to-nf.patch b/target/linux/generic/backport-4.19/352-v4.18-netfilter-nf_flow_table-rename-nf_flow_table.c-to-nf.patch new file mode 100644 index 0000000000..5df56dd643 --- /dev/null +++ b/target/linux/generic/backport-4.19/352-v4.18-netfilter-nf_flow_table-rename-nf_flow_table.c-to-nf.patch @@ -0,0 +1,952 @@ +From: Felix Fietkau <nbd@nbd.name> +Date: Fri, 16 Feb 2018 11:08:47 +0100 +Subject: [PATCH] netfilter: nf_flow_table: rename nf_flow_table.c to + nf_flow_table_core.c + +Preparation for adding more code to the same module + +Signed-off-by: Felix Fietkau <nbd@nbd.name> +--- + rename net/netfilter/{nf_flow_table.c => nf_flow_table_core.c} (100%) + +--- a/net/netfilter/Makefile ++++ b/net/netfilter/Makefile +@@ -113,6 +113,8 @@ obj-$(CONFIG_NFT_FWD_NETDEV) += nft_fwd_ + + # flow table infrastructure + obj-$(CONFIG_NF_FLOW_TABLE) += nf_flow_table.o ++nf_flow_table-objs := nf_flow_table_core.o ++ + obj-$(CONFIG_NF_FLOW_TABLE_INET) += nf_flow_table_inet.o + + # generic X tables +--- a/net/netfilter/nf_flow_table.c ++++ /dev/null +@@ -1,462 +0,0 @@ +-#include <linux/kernel.h> +-#include <linux/init.h> +-#include <linux/module.h> +-#include <linux/netfilter.h> +-#include <linux/rhashtable.h> +-#include <linux/netdevice.h> +-#include <net/ip.h> +-#include <net/ip6_route.h> +-#include <net/netfilter/nf_tables.h> +-#include <net/netfilter/nf_flow_table.h> +-#include <net/netfilter/nf_conntrack.h> +-#include <net/netfilter/nf_conntrack_core.h> +-#include <net/netfilter/nf_conntrack_tuple.h> +- +-struct flow_offload_entry { +- struct flow_offload flow; +- struct nf_conn *ct; +- struct rcu_head rcu_head; +-}; +- +-static void +-flow_offload_fill_dir(struct flow_offload *flow, struct nf_conn *ct, +- struct nf_flow_route *route, +- enum flow_offload_tuple_dir dir) +-{ +- struct flow_offload_tuple *ft = &flow->tuplehash[dir].tuple; +- struct nf_conntrack_tuple *ctt = &ct->tuplehash[dir].tuple; +- struct dst_entry *dst = route->tuple[dir].dst; +- +- ft->dir = dir; +- +- switch (ctt->src.l3num) { +- case NFPROTO_IPV4: +- ft->src_v4 = ctt->src.u3.in; +- ft->dst_v4 = ctt->dst.u3.in; +- ft->mtu = ip_dst_mtu_maybe_forward(dst, true); +- break; +- case NFPROTO_IPV6: +- ft->src_v6 = ctt->src.u3.in6; +- ft->dst_v6 = ctt->dst.u3.in6; +- ft->mtu = ip6_dst_mtu_forward(dst); +- break; +- } +- +- ft->l3proto = ctt->src.l3num; +- ft->l4proto = ctt->dst.protonum; +- ft->src_port = ctt->src.u.tcp.port; +- ft->dst_port = ctt->dst.u.tcp.port; +- +- ft->iifidx = route->tuple[dir].ifindex; +- ft->oifidx = route->tuple[!dir].ifindex; +- ft->dst_cache = dst; +-} +- +-struct flow_offload * +-flow_offload_alloc(struct nf_conn *ct, struct nf_flow_route *route) +-{ +- struct flow_offload_entry *entry; +- struct flow_offload *flow; +- +- if (unlikely(nf_ct_is_dying(ct) || +- !atomic_inc_not_zero(&ct->ct_general.use))) +- return NULL; +- +- entry = kzalloc(sizeof(*entry), GFP_ATOMIC); +- if (!entry) +- goto err_ct_refcnt; +- +- flow = &entry->flow; +- +- if (!dst_hold_safe(route->tuple[FLOW_OFFLOAD_DIR_ORIGINAL].dst)) +- goto err_dst_cache_original; +- +- if (!dst_hold_safe(route->tuple[FLOW_OFFLOAD_DIR_REPLY].dst)) +- goto err_dst_cache_reply; +- +- entry->ct = ct; +- +- flow_offload_fill_dir(flow, ct, route, FLOW_OFFLOAD_DIR_ORIGINAL); +- flow_offload_fill_dir(flow, ct, route, FLOW_OFFLOAD_DIR_REPLY); +- +- if (ct->status & IPS_SRC_NAT) +- flow->flags |= FLOW_OFFLOAD_SNAT; +- else if (ct->status & IPS_DST_NAT) +- flow->flags |= FLOW_OFFLOAD_DNAT; +- +- return flow; +- +-err_dst_cache_reply: +- dst_release(route->tuple[FLOW_OFFLOAD_DIR_ORIGINAL].dst); +-err_dst_cache_original: +- kfree(entry); +-err_ct_refcnt: +- nf_ct_put(ct); +- +- return NULL; +-} +-EXPORT_SYMBOL_GPL(flow_offload_alloc); +- +-void flow_offload_free(struct flow_offload *flow) +-{ +- struct flow_offload_entry *e; +- +- dst_release(flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_cache); +- dst_release(flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_cache); +- e = container_of(flow, struct flow_offload_entry, flow); +- nf_ct_delete(e->ct, 0, 0); +- nf_ct_put(e->ct); +- kfree_rcu(e, rcu_head); +-} +-EXPORT_SYMBOL_GPL(flow_offload_free); +- +-void flow_offload_dead(struct flow_offload *flow) +-{ +- flow->flags |= FLOW_OFFLOAD_DYING; +-} +-EXPORT_SYMBOL_GPL(flow_offload_dead); +- +-int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow) +-{ +- flow->timeout = (u32)jiffies; +- +- rhashtable_insert_fast(&flow_table->rhashtable, +- &flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].node, +- *flow_table->type->params); +- rhashtable_insert_fast(&flow_table->rhashtable, +- &flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].node, +- *flow_table->type->params); +- return 0; +-} +-EXPORT_SYMBOL_GPL(flow_offload_add); +- +-static void flow_offload_del(struct nf_flowtable *flow_table, +- struct flow_offload *flow) +-{ +- rhashtable_remove_fast(&flow_table->rhashtable, +- &flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].node, +- *flow_table->type->params); +- rhashtable_remove_fast(&flow_table->rhashtable, +- &flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].node, +- *flow_table->type->params); +- +- flow_offload_free(flow); +-} +- +-struct flow_offload_tuple_rhash * +-flow_offload_lookup(struct nf_flowtable *flow_table, +- struct flow_offload_tuple *tuple) +-{ +- return rhashtable_lookup_fast(&flow_table->rhashtable, tuple, +- *flow_table->type->params); +-} +-EXPORT_SYMBOL_GPL(flow_offload_lookup); +- +-int nf_flow_table_iterate(struct nf_flowtable *flow_table, +- void (*iter)(struct flow_offload *flow, void *data), +- void *data) +-{ +- struct flow_offload_tuple_rhash *tuplehash; +- struct rhashtable_iter hti; +- struct flow_offload *flow; +- int err; +- +- err = rhashtable_walk_init(&flow_table->rhashtable, &hti, GFP_KERNEL); +- if (err) +- return err; +- +- rhashtable_walk_start(&hti); +- +- while ((tuplehash = rhashtable_walk_next(&hti))) { +- if (IS_ERR(tuplehash)) { +- err = PTR_ERR(tuplehash); +- if (err != -EAGAIN) +- goto out; +- +- continue; +- } +- if (tuplehash->tuple.dir) +- continue; +- +- flow = container_of(tuplehash, struct flow_offload, tuplehash[0]); +- +- iter(flow, data); +- } +-out: +- rhashtable_walk_stop(&hti); +- rhashtable_walk_exit(&hti); +- +- return err; +-} +-EXPORT_SYMBOL_GPL(nf_flow_table_iterate); +- +-static inline bool nf_flow_has_expired(const struct flow_offload *flow) +-{ +- return (__s32)(flow->timeout - (u32)jiffies) <= 0; +-} +- +-static inline bool nf_flow_is_dying(const struct flow_offload *flow) +-{ +- return flow->flags & FLOW_OFFLOAD_DYING; +-} +- +-static int nf_flow_offload_gc_step(struct nf_flowtable *flow_table) +-{ +- struct flow_offload_tuple_rhash *tuplehash; +- struct rhashtable_iter hti; +- struct flow_offload *flow; +- int err; +- +- err = rhashtable_walk_init(&flow_table->rhashtable, &hti, GFP_KERNEL); +- if (err) +- return 0; +- +- rhashtable_walk_start(&hti); +- +- while ((tuplehash = rhashtable_walk_next(&hti))) { +- if (IS_ERR(tuplehash)) { +- err = PTR_ERR(tuplehash); +- if (err != -EAGAIN) +- goto out; +- +- continue; +- } +- if (tuplehash->tuple.dir) +- continue; +- +- flow = container_of(tuplehash, struct flow_offload, tuplehash[0]); +- +- if (nf_flow_has_expired(flow) || +- nf_flow_is_dying(flow)) +- flow_offload_del(flow_table, flow); +- } +-out: +- rhashtable_walk_stop(&hti); +- rhashtable_walk_exit(&hti); +- +- return 1; +-} +- +-void nf_flow_offload_work_gc(struct work_struct *work) +-{ +- struct nf_flowtable *flow_table; +- +- flow_table = container_of(work, struct nf_flowtable, gc_work.work); +- nf_flow_offload_gc_step(flow_table); +- queue_delayed_work(system_power_efficient_wq, &flow_table->gc_work, HZ); +-} +-EXPORT_SYMBOL_GPL(nf_flow_offload_work_gc); +- +-static u32 flow_offload_hash(const void *data, u32 len, u32 seed) +-{ +- const struct flow_offload_tuple *tuple = data; +- +- return jhash(tuple, offsetof(struct flow_offload_tuple, dir), seed); +-} +- +-static u32 flow_offload_hash_obj(const void *data, u32 len, u32 seed) +-{ +- const struct flow_offload_tuple_rhash *tuplehash = data; +- +- return jhash(&tuplehash->tuple, offsetof(struct flow_offload_tuple, dir), seed); +-} +- +-static int flow_offload_hash_cmp(struct rhashtable_compare_arg *arg, +- const void *ptr) +-{ +- const struct flow_offload_tuple *tuple = arg->key; +- const struct flow_offload_tuple_rhash *x = ptr; +- +- if (memcmp(&x->tuple, tuple, offsetof(struct flow_offload_tuple, dir))) +- return 1; +- +- return 0; +-} +- +-const struct rhashtable_params nf_flow_offload_rhash_params = { +- .head_offset = offsetof(struct flow_offload_tuple_rhash, node), +- .hashfn = flow_offload_hash, +- .obj_hashfn = flow_offload_hash_obj, +- .obj_cmpfn = flow_offload_hash_cmp, +- .automatic_shrinking = true, +-}; +-EXPORT_SYMBOL_GPL(nf_flow_offload_rhash_params); +- +-static int nf_flow_nat_port_tcp(struct sk_buff *skb, unsigned int thoff, +- __be16 port, __be16 new_port) +-{ +- struct tcphdr *tcph; +- +- if (!pskb_may_pull(skb, thoff + sizeof(*tcph)) || +- skb_try_make_writable(skb, thoff + sizeof(*tcph))) +- return -1; +- +- tcph = (void *)(skb_network_header(skb) + thoff); +- inet_proto_csum_replace2(&tcph->check, skb, port, new_port, true); +- +- return 0; +-} +- +-static int nf_flow_nat_port_udp(struct sk_buff *skb, unsigned int thoff, +- __be16 port, __be16 new_port) +-{ +- struct udphdr *udph; +- +- if (!pskb_may_pull(skb, thoff + sizeof(*udph)) || +- skb_try_make_writable(skb, thoff + sizeof(*udph))) +- return -1; +- +- udph = (void *)(skb_network_header(skb) + thoff); +- if (udph->check || skb->ip_summed == CHECKSUM_PARTIAL) { +- inet_proto_csum_replace2(&udph->check, skb, port, +- new_port, true); +- if (!udph->check) +- udph->check = CSUM_MANGLED_0; +- } +- +- return 0; +-} +- +-static int nf_flow_nat_port(struct sk_buff *skb, unsigned int thoff, +- u8 protocol, __be16 port, __be16 new_port) +-{ +- switch (protocol) { +- case IPPROTO_TCP: +- if (nf_flow_nat_port_tcp(skb, thoff, port, new_port) < 0) +- return NF_DROP; +- break; +- case IPPROTO_UDP: +- if (nf_flow_nat_port_udp(skb, thoff, port, new_port) < 0) +- return NF_DROP; +- break; +- } +- +- return 0; +-} +- +-int nf_flow_snat_port(const struct flow_offload *flow, +- struct sk_buff *skb, unsigned int thoff, +- u8 protocol, enum flow_offload_tuple_dir dir) +-{ +- struct flow_ports *hdr; +- __be16 port, new_port; +- +- if (!pskb_may_pull(skb, thoff + sizeof(*hdr)) || +- skb_try_make_writable(skb, thoff + sizeof(*hdr))) +- return -1; +- +- hdr = (void *)(skb_network_header(skb) + thoff); +- +- switch (dir) { +- case FLOW_OFFLOAD_DIR_ORIGINAL: +- port = hdr->source; +- new_port = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_port; +- hdr->source = new_port; +- break; +- case FLOW_OFFLOAD_DIR_REPLY: +- port = hdr->dest; +- new_port = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_port; +- hdr->dest = new_port; +- break; +- default: +- return -1; +- } +- +- return nf_flow_nat_port(skb, thoff, protocol, port, new_port); +-} +-EXPORT_SYMBOL_GPL(nf_flow_snat_port); +- +-int nf_flow_dnat_port(const struct flow_offload *flow, +- struct sk_buff *skb, unsigned int thoff, +- u8 protocol, enum flow_offload_tuple_dir dir) +-{ +- struct flow_ports *hdr; +- __be16 port, new_port; +- +- if (!pskb_may_pull(skb, thoff + sizeof(*hdr)) || +- skb_try_make_writable(skb, thoff + sizeof(*hdr))) +- return -1; +- +- hdr = (void *)(skb_network_header(skb) + thoff); +- +- switch (dir) { +- case FLOW_OFFLOAD_DIR_ORIGINAL: +- port = hdr->dest; +- new_port = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_port; +- hdr->dest = new_port; +- break; +- case FLOW_OFFLOAD_DIR_REPLY: +- port = hdr->source; +- new_port = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_port; +- hdr->source = new_port; +- break; +- default: +- return -1; +- } +- +- return nf_flow_nat_port(skb, thoff, protocol, port, new_port); +-} +-EXPORT_SYMBOL_GPL(nf_flow_dnat_port); +- +-static void nf_flow_table_do_cleanup(struct flow_offload *flow, void *data) +-{ +- struct net_device *dev = data; +- +- if (dev && flow->tuplehash[0].tuple.iifidx != dev->ifindex) +- return; +- +- flow_offload_dead(flow); +-} +- +-static void nf_flow_table_iterate_cleanup(struct nf_flowtable *flowtable, +- void *data) +-{ +- nf_flow_table_iterate(flowtable, nf_flow_table_do_cleanup, data); +- flush_delayed_work(&flowtable->gc_work); +-} +- +-void nf_flow_table_cleanup(struct net *net, struct net_device *dev) +-{ +- nft_flow_table_iterate(net, nf_flow_table_iterate_cleanup, dev); +-} +-EXPORT_SYMBOL_GPL(nf_flow_table_cleanup); +- +-void nf_flow_table_free(struct nf_flowtable *flow_table) +-{ +- nf_flow_table_iterate(flow_table, nf_flow_table_do_cleanup, NULL); +- WARN_ON(!nf_flow_offload_gc_step(flow_table)); +-} +-EXPORT_SYMBOL_GPL(nf_flow_table_free); +- +-static int nf_flow_table_netdev_event(struct notifier_block *this, +- unsigned long event, void *ptr) +-{ +- struct net_device *dev = netdev_notifier_info_to_dev(ptr); +- +- if (event != NETDEV_DOWN) +- return NOTIFY_DONE; +- +- nf_flow_table_cleanup(dev_net(dev), dev); +- +- return NOTIFY_DONE; +-} +- +-static struct notifier_block flow_offload_netdev_notifier = { +- .notifier_call = nf_flow_table_netdev_event, +-}; +- +-static int __init nf_flow_table_module_init(void) +-{ +- return register_netdevice_notifier(&flow_offload_netdev_notifier); +-} +- +-static void __exit nf_flow_table_module_exit(void) +-{ +- unregister_netdevice_notifier(&flow_offload_netdev_notifier); +-} +- +-module_init(nf_flow_table_module_init); +-module_exit(nf_flow_table_module_exit); +- +-MODULE_LICENSE("GPL"); +-MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>"); +--- /dev/null ++++ b/net/netfilter/nf_flow_table_core.c +@@ -0,0 +1,462 @@ ++#include <linux/kernel.h> ++#include <linux/init.h> ++#include <linux/module.h> ++#include <linux/netfilter.h> ++#include <linux/rhashtable.h> ++#include <linux/netdevice.h> ++#include <net/ip.h> ++#include <net/ip6_route.h> ++#include <net/netfilter/nf_tables.h> ++#include <net/netfilter/nf_flow_table.h> ++#include <net/netfilter/nf_conntrack.h> ++#include <net/netfilter/nf_conntrack_core.h> ++#include <net/netfilter/nf_conntrack_tuple.h> ++ ++struct flow_offload_entry { ++ struct flow_offload flow; ++ struct nf_conn *ct; ++ struct rcu_head rcu_head; ++}; ++ ++static void ++flow_offload_fill_dir(struct flow_offload *flow, struct nf_conn *ct, ++ struct nf_flow_route *route, ++ enum flow_offload_tuple_dir dir) ++{ ++ struct flow_offload_tuple *ft = &flow->tuplehash[dir].tuple; ++ struct nf_conntrack_tuple *ctt = &ct->tuplehash[dir].tuple; ++ struct dst_entry *dst = route->tuple[dir].dst; ++ ++ ft->dir = dir; ++ ++ switch (ctt->src.l3num) { ++ case NFPROTO_IPV4: ++ ft->src_v4 = ctt->src.u3.in; ++ ft->dst_v4 = ctt->dst.u3.in; ++ ft->mtu = ip_dst_mtu_maybe_forward(dst, true); ++ break; ++ case NFPROTO_IPV6: ++ ft->src_v6 = ctt->src.u3.in6; ++ ft->dst_v6 = ctt->dst.u3.in6; ++ ft->mtu = ip6_dst_mtu_forward(dst); ++ break; ++ } ++ ++ ft->l3proto = ctt->src.l3num; ++ ft->l4proto = ctt->dst.protonum; ++ ft->src_port = ctt->src.u.tcp.port; ++ ft->dst_port = ctt->dst.u.tcp.port; ++ ++ ft->iifidx = route->tuple[dir].ifindex; ++ ft->oifidx = route->tuple[!dir].ifindex; ++ ft->dst_cache = dst; ++} ++ ++struct flow_offload * ++flow_offload_alloc(struct nf_conn *ct, struct nf_flow_route *route) ++{ ++ struct flow_offload_entry *entry; ++ struct flow_offload *flow; ++ ++ if (unlikely(nf_ct_is_dying(ct) || ++ !atomic_inc_not_zero(&ct->ct_general.use))) ++ return NULL; ++ ++ entry = kzalloc(sizeof(*entry), GFP_ATOMIC); ++ if (!entry) ++ goto err_ct_refcnt; ++ ++ flow = &entry->flow; ++ ++ if (!dst_hold_safe(route->tuple[FLOW_OFFLOAD_DIR_ORIGINAL].dst)) ++ goto err_dst_cache_original; ++ ++ if (!dst_hold_safe(route->tuple[FLOW_OFFLOAD_DIR_REPLY].dst)) ++ goto err_dst_cache_reply; ++ ++ entry->ct = ct; ++ ++ flow_offload_fill_dir(flow, ct, route, FLOW_OFFLOAD_DIR_ORIGINAL); ++ flow_offload_fill_dir(flow, ct, route, FLOW_OFFLOAD_DIR_REPLY); ++ ++ if (ct->status & IPS_SRC_NAT) ++ flow->flags |= FLOW_OFFLOAD_SNAT; ++ else if (ct->status & IPS_DST_NAT) ++ flow->flags |= FLOW_OFFLOAD_DNAT; ++ ++ return flow; ++ ++err_dst_cache_reply: ++ dst_release(route->tuple[FLOW_OFFLOAD_DIR_ORIGINAL].dst); ++err_dst_cache_original: ++ kfree(entry); ++err_ct_refcnt: ++ nf_ct_put(ct); ++ ++ return NULL; ++} ++EXPORT_SYMBOL_GPL(flow_offload_alloc); ++ ++void flow_offload_free(struct flow_offload *flow) ++{ ++ struct flow_offload_entry *e; ++ ++ dst_release(flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_cache); ++ dst_release(flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_cache); ++ e = container_of(flow, struct flow_offload_entry, flow); ++ nf_ct_delete(e->ct, 0, 0); ++ nf_ct_put(e->ct); ++ kfree_rcu(e, rcu_head); ++} ++EXPORT_SYMBOL_GPL(flow_offload_free); ++ ++void flow_offload_dead(struct flow_offload *flow) ++{ ++ flow->flags |= FLOW_OFFLOAD_DYING; ++} ++EXPORT_SYMBOL_GPL(flow_offload_dead); ++ ++int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow) ++{ ++ flow->timeout = (u32)jiffies; ++ ++ rhashtable_insert_fast(&flow_table->rhashtable, ++ &flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].node, ++ *flow_table->type->params); ++ rhashtable_insert_fast(&flow_table->rhashtable, ++ &flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].node, ++ *flow_table->type->params); ++ return 0; ++} ++EXPORT_SYMBOL_GPL(flow_offload_add); ++ ++static void flow_offload_del(struct nf_flowtable *flow_table, ++ struct flow_offload *flow) ++{ ++ rhashtable_remove_fast(&flow_table->rhashtable, ++ &flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].node, ++ *flow_table->type->params); ++ rhashtable_remove_fast(&flow_table->rhashtable, ++ &flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].node, ++ *flow_table->type->params); ++ ++ flow_offload_free(flow); ++} ++ ++struct flow_offload_tuple_rhash * ++flow_offload_lookup(struct nf_flowtable *flow_table, ++ struct flow_offload_tuple *tuple) ++{ ++ return rhashtable_lookup_fast(&flow_table->rhashtable, tuple, ++ *flow_table->type->params); ++} ++EXPORT_SYMBOL_GPL(flow_offload_lookup); ++ ++int nf_flow_table_iterate(struct nf_flowtable *flow_table, ++ void (*iter)(struct flow_offload *flow, void *data), ++ void *data) ++{ ++ struct flow_offload_tuple_rhash *tuplehash; ++ struct rhashtable_iter hti; ++ struct flow_offload *flow; ++ int err; ++ ++ err = rhashtable_walk_init(&flow_table->rhashtable, &hti, GFP_KERNEL); ++ if (err) ++ return err; ++ ++ rhashtable_walk_start(&hti); ++ ++ while ((tuplehash = rhashtable_walk_next(&hti))) { ++ if (IS_ERR(tuplehash)) { ++ err = PTR_ERR(tuplehash); ++ if (err != -EAGAIN) ++ goto out; ++ ++ continue; ++ } ++ if (tuplehash->tuple.dir) ++ continue; ++ ++ flow = container_of(tuplehash, struct flow_offload, tuplehash[0]); ++ ++ iter(flow, data); ++ } ++out: ++ rhashtable_walk_stop(&hti); ++ rhashtable_walk_exit(&hti); ++ ++ return err; ++} ++EXPORT_SYMBOL_GPL(nf_flow_table_iterate); ++ ++static inline bool nf_flow_has_expired(const struct flow_offload *flow) ++{ ++ return (__s32)(flow->timeout - (u32)jiffies) <= 0; ++} ++ ++static inline bool nf_flow_is_dying(const struct flow_offload *flow) ++{ ++ return flow->flags & FLOW_OFFLOAD_DYING; ++} ++ ++static int nf_flow_offload_gc_step(struct nf_flowtable *flow_table) ++{ ++ struct flow_offload_tuple_rhash *tuplehash; ++ struct rhashtable_iter hti; ++ struct flow_offload *flow; ++ int err; ++ ++ err = rhashtable_walk_init(&flow_table->rhashtable, &hti, GFP_KERNEL); ++ if (err) ++ return 0; ++ ++ rhashtable_walk_start(&hti); ++ ++ while ((tuplehash = rhashtable_walk_next(&hti))) { ++ if (IS_ERR(tuplehash)) { ++ err = PTR_ERR(tuplehash); ++ if (err != -EAGAIN) ++ goto out; ++ ++ continue; ++ } ++ if (tuplehash->tuple.dir) ++ continue; ++ ++ flow = container_of(tuplehash, struct flow_offload, tuplehash[0]); ++ ++ if (nf_flow_has_expired(flow) || ++ nf_flow_is_dying(flow)) ++ flow_offload_del(flow_table, flow); ++ } ++out: ++ rhashtable_walk_stop(&hti); ++ rhashtable_walk_exit(&hti); ++ ++ return 1; ++} ++ ++void nf_flow_offload_work_gc(struct work_struct *work) ++{ ++ struct nf_flowtable *flow_table; ++ ++ flow_table = container_of(work, struct nf_flowtable, gc_work.work); ++ nf_flow_offload_gc_step(flow_table); ++ queue_delayed_work(system_power_efficient_wq, &flow_table->gc_work, HZ); ++} ++EXPORT_SYMBOL_GPL(nf_flow_offload_work_gc); ++ ++static u32 flow_offload_hash(const void *data, u32 len, u32 seed) ++{ ++ const struct flow_offload_tuple *tuple = data; ++ ++ return jhash(tuple, offsetof(struct flow_offload_tuple, dir), seed); ++} ++ ++static u32 flow_offload_hash_obj(const void *data, u32 len, u32 seed) ++{ ++ const struct flow_offload_tuple_rhash *tuplehash = data; ++ ++ return jhash(&tuplehash->tuple, offsetof(struct flow_offload_tuple, dir), seed); ++} ++ ++static int flow_offload_hash_cmp(struct rhashtable_compare_arg *arg, ++ const void *ptr) ++{ ++ const struct flow_offload_tuple *tuple = arg->key; ++ const struct flow_offload_tuple_rhash *x = ptr; ++ ++ if (memcmp(&x->tuple, tuple, offsetof(struct flow_offload_tuple, dir))) ++ return 1; ++ ++ return 0; ++} ++ ++const struct rhashtable_params nf_flow_offload_rhash_params = { ++ .head_offset = offsetof(struct flow_offload_tuple_rhash, node), ++ .hashfn = flow_offload_hash, ++ .obj_hashfn = flow_offload_hash_obj, ++ .obj_cmpfn = flow_offload_hash_cmp, ++ .automatic_shrinking = true, ++}; ++EXPORT_SYMBOL_GPL(nf_flow_offload_rhash_params); ++ ++static int nf_flow_nat_port_tcp(struct sk_buff *skb, unsigned int thoff, ++ __be16 port, __be16 new_port) ++{ ++ struct tcphdr *tcph; ++ ++ if (!pskb_may_pull(skb, thoff + sizeof(*tcph)) || ++ skb_try_make_writable(skb, thoff + sizeof(*tcph))) ++ return -1; ++ ++ tcph = (void *)(skb_network_header(skb) + thoff); ++ inet_proto_csum_replace2(&tcph->check, skb, port, new_port, true); ++ ++ return 0; ++} ++ ++static int nf_flow_nat_port_udp(struct sk_buff *skb, unsigned int thoff, ++ __be16 port, __be16 new_port) ++{ ++ struct udphdr *udph; ++ ++ if (!pskb_may_pull(skb, thoff + sizeof(*udph)) || ++ skb_try_make_writable(skb, thoff + sizeof(*udph))) ++ return -1; ++ ++ udph = (void *)(skb_network_header(skb) + thoff); ++ if (udph->check || skb->ip_summed == CHECKSUM_PARTIAL) { ++ inet_proto_csum_replace2(&udph->check, skb, port, ++ new_port, true); ++ if (!udph->check) ++ udph->check = CSUM_MANGLED_0; ++ } ++ ++ return 0; ++} ++ ++static int nf_flow_nat_port(struct sk_buff *skb, unsigned int thoff, ++ u8 protocol, __be16 port, __be16 new_port) ++{ ++ switch (protocol) { ++ case IPPROTO_TCP: ++ if (nf_flow_nat_port_tcp(skb, thoff, port, new_port) < 0) ++ return NF_DROP; ++ break; ++ case IPPROTO_UDP: ++ if (nf_flow_nat_port_udp(skb, thoff, port, new_port) < 0) ++ return NF_DROP; ++ break; ++ } ++ ++ return 0; ++} ++ ++int nf_flow_snat_port(const struct flow_offload *flow, ++ struct sk_buff *skb, unsigned int thoff, ++ u8 protocol, enum flow_offload_tuple_dir dir) ++{ ++ struct flow_ports *hdr; ++ __be16 port, new_port; ++ ++ if (!pskb_may_pull(skb, thoff + sizeof(*hdr)) || ++ skb_try_make_writable(skb, thoff + sizeof(*hdr))) ++ return -1; ++ ++ hdr = (void *)(skb_network_header(skb) + thoff); ++ ++ switch (dir) { ++ case FLOW_OFFLOAD_DIR_ORIGINAL: ++ port = hdr->source; ++ new_port = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_port; ++ hdr->source = new_port; ++ break; ++ case FLOW_OFFLOAD_DIR_REPLY: ++ port = hdr->dest; ++ new_port = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_port; ++ hdr->dest = new_port; ++ break; ++ default: ++ return -1; ++ } ++ ++ return nf_flow_nat_port(skb, thoff, protocol, port, new_port); ++} ++EXPORT_SYMBOL_GPL(nf_flow_snat_port); ++ ++int nf_flow_dnat_port(const struct flow_offload *flow, ++ struct sk_buff *skb, unsigned int thoff, ++ u8 protocol, enum flow_offload_tuple_dir dir) ++{ ++ struct flow_ports *hdr; ++ __be16 port, new_port; ++ ++ if (!pskb_may_pull(skb, thoff + sizeof(*hdr)) || ++ skb_try_make_writable(skb, thoff + sizeof(*hdr))) ++ return -1; ++ ++ hdr = (void *)(skb_network_header(skb) + thoff); ++ ++ switch (dir) { ++ case FLOW_OFFLOAD_DIR_ORIGINAL: ++ port = hdr->dest; ++ new_port = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_port; ++ hdr->dest = new_port; ++ break; ++ case FLOW_OFFLOAD_DIR_REPLY: ++ port = hdr->source; ++ new_port = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_port; ++ hdr->source = new_port; ++ break; ++ default: ++ return -1; ++ } ++ ++ return nf_flow_nat_port(skb, thoff, protocol, port, new_port); ++} ++EXPORT_SYMBOL_GPL(nf_flow_dnat_port); ++ ++static void nf_flow_table_do_cleanup(struct flow_offload *flow, void *data) ++{ ++ struct net_device *dev = data; ++ ++ if (dev && flow->tuplehash[0].tuple.iifidx != dev->ifindex) ++ return; ++ ++ flow_offload_dead(flow); ++} ++ ++static void nf_flow_table_iterate_cleanup(struct nf_flowtable *flowtable, ++ void *data) ++{ ++ nf_flow_table_iterate(flowtable, nf_flow_table_do_cleanup, data); ++ flush_delayed_work(&flowtable->gc_work); ++} ++ ++void nf_flow_table_cleanup(struct net *net, struct net_device *dev) ++{ ++ nft_flow_table_iterate(net, nf_flow_table_iterate_cleanup, dev); ++} ++EXPORT_SYMBOL_GPL(nf_flow_table_cleanup); ++ ++void nf_flow_table_free(struct nf_flowtable *flow_table) ++{ ++ nf_flow_table_iterate(flow_table, nf_flow_table_do_cleanup, NULL); ++ WARN_ON(!nf_flow_offload_gc_step(flow_table)); ++} ++EXPORT_SYMBOL_GPL(nf_flow_table_free); ++ ++static int nf_flow_table_netdev_event(struct notifier_block *this, ++ unsigned long event, void *ptr) ++{ ++ struct net_device *dev = netdev_notifier_info_to_dev(ptr); ++ ++ if (event != NETDEV_DOWN) ++ return NOTIFY_DONE; ++ ++ nf_flow_table_cleanup(dev_net(dev), dev); ++ ++ return NOTIFY_DONE; ++} ++ ++static struct notifier_block flow_offload_netdev_notifier = { ++ .notifier_call = nf_flow_table_netdev_event, ++}; ++ ++static int __init nf_flow_table_module_init(void) ++{ ++ return register_netdevice_notifier(&flow_offload_netdev_notifier); ++} ++ ++static void __exit nf_flow_table_module_exit(void) ++{ ++ unregister_netdevice_notifier(&flow_offload_netdev_notifier); ++} ++ ++module_init(nf_flow_table_module_init); ++module_exit(nf_flow_table_module_exit); ++ ++MODULE_LICENSE("GPL"); ++MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>"); diff --git a/target/linux/generic/backport-4.19/353-v4.18-netfilter-nf_flow_table-move-ipv4-offload-hook-code-.patch b/target/linux/generic/backport-4.19/353-v4.18-netfilter-nf_flow_table-move-ipv4-offload-hook-code-.patch new file mode 100644 index 0000000000..e25a66f934 --- /dev/null +++ b/target/linux/generic/backport-4.19/353-v4.18-netfilter-nf_flow_table-move-ipv4-offload-hook-code-.patch @@ -0,0 +1,522 @@ +From: Felix Fietkau <nbd@nbd.name> +Date: Sat, 17 Feb 2018 11:49:44 +0100 +Subject: [PATCH] netfilter: nf_flow_table: move ipv4 offload hook code to + nf_flow_table + +Allows some minor code sharing with the ipv6 hook code and is also +useful as preparation for adding iptables support for offload + +Signed-off-by: Felix Fietkau <nbd@nbd.name> +--- + create mode 100644 net/netfilter/nf_flow_table_ip.c + +--- a/net/ipv4/netfilter/nf_flow_table_ipv4.c ++++ b/net/ipv4/netfilter/nf_flow_table_ipv4.c +@@ -2,248 +2,8 @@ + #include <linux/init.h> + #include <linux/module.h> + #include <linux/netfilter.h> +-#include <linux/rhashtable.h> +-#include <linux/ip.h> +-#include <linux/netdevice.h> +-#include <net/ip.h> +-#include <net/neighbour.h> + #include <net/netfilter/nf_flow_table.h> + #include <net/netfilter/nf_tables.h> +-/* For layer 4 checksum field offset. */ +-#include <linux/tcp.h> +-#include <linux/udp.h> +- +-static int nf_flow_nat_ip_tcp(struct sk_buff *skb, unsigned int thoff, +- __be32 addr, __be32 new_addr) +-{ +- struct tcphdr *tcph; +- +- if (!pskb_may_pull(skb, thoff + sizeof(*tcph)) || +- skb_try_make_writable(skb, thoff + sizeof(*tcph))) +- return -1; +- +- tcph = (void *)(skb_network_header(skb) + thoff); +- inet_proto_csum_replace4(&tcph->check, skb, addr, new_addr, true); +- +- return 0; +-} +- +-static int nf_flow_nat_ip_udp(struct sk_buff *skb, unsigned int thoff, +- __be32 addr, __be32 new_addr) +-{ +- struct udphdr *udph; +- +- if (!pskb_may_pull(skb, thoff + sizeof(*udph)) || +- skb_try_make_writable(skb, thoff + sizeof(*udph))) +- return -1; +- +- udph = (void *)(skb_network_header(skb) + thoff); +- if (udph->check || skb->ip_summed == CHECKSUM_PARTIAL) { +- inet_proto_csum_replace4(&udph->check, skb, addr, +- new_addr, true); +- if (!udph->check) +- udph->check = CSUM_MANGLED_0; +- } +- +- return 0; +-} +- +-static int nf_flow_nat_ip_l4proto(struct sk_buff *skb, struct iphdr *iph, +- unsigned int thoff, __be32 addr, +- __be32 new_addr) +-{ +- switch (iph->protocol) { +- case IPPROTO_TCP: +- if (nf_flow_nat_ip_tcp(skb, thoff, addr, new_addr) < 0) +- return NF_DROP; +- break; +- case IPPROTO_UDP: +- if (nf_flow_nat_ip_udp(skb, thoff, addr, new_addr) < 0) +- return NF_DROP; +- break; +- } +- +- return 0; +-} +- +-static int nf_flow_snat_ip(const struct flow_offload *flow, struct sk_buff *skb, +- struct iphdr *iph, unsigned int thoff, +- enum flow_offload_tuple_dir dir) +-{ +- __be32 addr, new_addr; +- +- switch (dir) { +- case FLOW_OFFLOAD_DIR_ORIGINAL: +- addr = iph->saddr; +- new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_v4.s_addr; +- iph->saddr = new_addr; +- break; +- case FLOW_OFFLOAD_DIR_REPLY: +- addr = iph->daddr; +- new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_v4.s_addr; +- iph->daddr = new_addr; +- break; +- default: +- return -1; +- } +- csum_replace4(&iph->check, addr, new_addr); +- +- return nf_flow_nat_ip_l4proto(skb, iph, thoff, addr, new_addr); +-} +- +-static int nf_flow_dnat_ip(const struct flow_offload *flow, struct sk_buff *skb, +- struct iphdr *iph, unsigned int thoff, +- enum flow_offload_tuple_dir dir) +-{ +- __be32 addr, new_addr; +- +- switch (dir) { +- case FLOW_OFFLOAD_DIR_ORIGINAL: +- addr = iph->daddr; +- new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_v4.s_addr; +- iph->daddr = new_addr; +- break; +- case FLOW_OFFLOAD_DIR_REPLY: +- addr = iph->saddr; +- new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_v4.s_addr; +- iph->saddr = new_addr; +- break; +- default: +- return -1; +- } +- +- return nf_flow_nat_ip_l4proto(skb, iph, thoff, addr, new_addr); +-} +- +-static int nf_flow_nat_ip(const struct flow_offload *flow, struct sk_buff *skb, +- enum flow_offload_tuple_dir dir) +-{ +- struct iphdr *iph = ip_hdr(skb); +- unsigned int thoff = iph->ihl * 4; +- +- if (flow->flags & FLOW_OFFLOAD_SNAT && +- (nf_flow_snat_port(flow, skb, thoff, iph->protocol, dir) < 0 || +- nf_flow_snat_ip(flow, skb, iph, thoff, dir) < 0)) +- return -1; +- if (flow->flags & FLOW_OFFLOAD_DNAT && +- (nf_flow_dnat_port(flow, skb, thoff, iph->protocol, dir) < 0 || +- nf_flow_dnat_ip(flow, skb, iph, thoff, dir) < 0)) +- return -1; +- +- return 0; +-} +- +-static bool ip_has_options(unsigned int thoff) +-{ +- return thoff != sizeof(struct iphdr); +-} +- +-static int nf_flow_tuple_ip(struct sk_buff *skb, const struct net_device *dev, +- struct flow_offload_tuple *tuple) +-{ +- struct flow_ports *ports; +- unsigned int thoff; +- struct iphdr *iph; +- +- if (!pskb_may_pull(skb, sizeof(*iph))) +- return -1; +- +- iph = ip_hdr(skb); +- thoff = iph->ihl * 4; +- +- if (ip_is_fragment(iph) || +- unlikely(ip_has_options(thoff))) +- return -1; +- +- if (iph->protocol != IPPROTO_TCP && +- iph->protocol != IPPROTO_UDP) +- return -1; +- +- thoff = iph->ihl * 4; +- if (!pskb_may_pull(skb, thoff + sizeof(*ports))) +- return -1; +- +- ports = (struct flow_ports *)(skb_network_header(skb) + thoff); +- +- tuple->src_v4.s_addr = iph->saddr; +- tuple->dst_v4.s_addr = iph->daddr; +- tuple->src_port = ports->source; +- tuple->dst_port = ports->dest; +- tuple->l3proto = AF_INET; +- tuple->l4proto = iph->protocol; +- tuple->iifidx = dev->ifindex; +- +- return 0; +-} +- +-/* Based on ip_exceeds_mtu(). */ +-static bool nf_flow_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu) +-{ +- if (skb->len <= mtu) +- return false; +- +- if ((ip_hdr(skb)->frag_off & htons(IP_DF)) == 0) +- return false; +- +- if (skb_is_gso(skb) && skb_gso_validate_mtu(skb, mtu)) +- return false; +- +- return true; +-} +- +-unsigned int +-nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb, +- const struct nf_hook_state *state) +-{ +- struct flow_offload_tuple_rhash *tuplehash; +- struct nf_flowtable *flow_table = priv; +- struct flow_offload_tuple tuple = {}; +- enum flow_offload_tuple_dir dir; +- struct flow_offload *flow; +- struct net_device *outdev; +- const struct rtable *rt; +- struct iphdr *iph; +- __be32 nexthop; +- +- if (skb->protocol != htons(ETH_P_IP)) +- return NF_ACCEPT; +- +- if (nf_flow_tuple_ip(skb, state->in, &tuple) < 0) +- return NF_ACCEPT; +- +- tuplehash = flow_offload_lookup(flow_table, &tuple); +- if (tuplehash == NULL) +- return NF_ACCEPT; +- +- outdev = dev_get_by_index_rcu(state->net, tuplehash->tuple.oifidx); +- if (!outdev) +- return NF_ACCEPT; +- +- dir = tuplehash->tuple.dir; +- flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]); +- rt = (const struct rtable *)flow->tuplehash[dir].tuple.dst_cache; +- +- if (unlikely(nf_flow_exceeds_mtu(skb, flow->tuplehash[dir].tuple.mtu))) +- return NF_ACCEPT; +- +- if (skb_try_make_writable(skb, sizeof(*iph))) +- return NF_DROP; +- +- if (flow->flags & (FLOW_OFFLOAD_SNAT | FLOW_OFFLOAD_DNAT) && +- nf_flow_nat_ip(flow, skb, dir) < 0) +- return NF_DROP; +- +- flow->timeout = (u32)jiffies + NF_FLOW_TIMEOUT; +- iph = ip_hdr(skb); +- ip_decrease_ttl(iph); +- +- skb->dev = outdev; +- nexthop = rt_nexthop(rt, flow->tuplehash[!dir].tuple.src_v4.s_addr); +- neigh_xmit(NEIGH_ARP_TABLE, outdev, &nexthop, skb); +- +- return NF_STOLEN; +-} +-EXPORT_SYMBOL_GPL(nf_flow_offload_ip_hook); + + static struct nf_flowtable_type flowtable_ipv4 = { + .family = NFPROTO_IPV4, +--- a/net/netfilter/Makefile ++++ b/net/netfilter/Makefile +@@ -113,7 +113,7 @@ obj-$(CONFIG_NFT_FWD_NETDEV) += nft_fwd_ + + # flow table infrastructure + obj-$(CONFIG_NF_FLOW_TABLE) += nf_flow_table.o +-nf_flow_table-objs := nf_flow_table_core.o ++nf_flow_table-objs := nf_flow_table_core.o nf_flow_table_ip.o + + obj-$(CONFIG_NF_FLOW_TABLE_INET) += nf_flow_table_inet.o + +--- /dev/null ++++ b/net/netfilter/nf_flow_table_ip.c +@@ -0,0 +1,245 @@ ++#include <linux/kernel.h> ++#include <linux/init.h> ++#include <linux/module.h> ++#include <linux/netfilter.h> ++#include <linux/rhashtable.h> ++#include <linux/ip.h> ++#include <linux/netdevice.h> ++#include <net/ip.h> ++#include <net/neighbour.h> ++#include <net/netfilter/nf_flow_table.h> ++/* For layer 4 checksum field offset. */ ++#include <linux/tcp.h> ++#include <linux/udp.h> ++ ++static int nf_flow_nat_ip_tcp(struct sk_buff *skb, unsigned int thoff, ++ __be32 addr, __be32 new_addr) ++{ ++ struct tcphdr *tcph; ++ ++ if (!pskb_may_pull(skb, thoff + sizeof(*tcph)) || ++ skb_try_make_writable(skb, thoff + sizeof(*tcph))) ++ return -1; ++ ++ tcph = (void *)(skb_network_header(skb) + thoff); ++ inet_proto_csum_replace4(&tcph->check, skb, addr, new_addr, true); ++ ++ return 0; ++} ++ ++static int nf_flow_nat_ip_udp(struct sk_buff *skb, unsigned int thoff, ++ __be32 addr, __be32 new_addr) ++{ ++ struct udphdr *udph; ++ ++ if (!pskb_may_pull(skb, thoff + sizeof(*udph)) || ++ skb_try_make_writable(skb, thoff + sizeof(*udph))) ++ return -1; ++ ++ udph = (void *)(skb_network_header(skb) + thoff); ++ if (udph->check || skb->ip_summed == CHECKSUM_PARTIAL) { ++ inet_proto_csum_replace4(&udph->check, skb, addr, ++ new_addr, true); ++ if (!udph->check) ++ udph->check = CSUM_MANGLED_0; ++ } ++ ++ return 0; ++} ++ ++static int nf_flow_nat_ip_l4proto(struct sk_buff *skb, struct iphdr *iph, ++ unsigned int thoff, __be32 addr, ++ __be32 new_addr) ++{ ++ switch (iph->protocol) { ++ case IPPROTO_TCP: ++ if (nf_flow_nat_ip_tcp(skb, thoff, addr, new_addr) < 0) ++ return NF_DROP; ++ break; ++ case IPPROTO_UDP: ++ if (nf_flow_nat_ip_udp(skb, thoff, addr, new_addr) < 0) ++ return NF_DROP; ++ break; ++ } ++ ++ return 0; ++} ++ ++static int nf_flow_snat_ip(const struct flow_offload *flow, struct sk_buff *skb, ++ struct iphdr *iph, unsigned int thoff, ++ enum flow_offload_tuple_dir dir) ++{ ++ __be32 addr, new_addr; ++ ++ switch (dir) { ++ case FLOW_OFFLOAD_DIR_ORIGINAL: ++ addr = iph->saddr; ++ new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_v4.s_addr; ++ iph->saddr = new_addr; ++ break; ++ case FLOW_OFFLOAD_DIR_REPLY: ++ addr = iph->daddr; ++ new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_v4.s_addr; ++ iph->daddr = new_addr; ++ break; ++ default: ++ return -1; ++ } ++ csum_replace4(&iph->check, addr, new_addr); ++ ++ return nf_flow_nat_ip_l4proto(skb, iph, thoff, addr, new_addr); ++} ++ ++static int nf_flow_dnat_ip(const struct flow_offload *flow, struct sk_buff *skb, ++ struct iphdr *iph, unsigned int thoff, ++ enum flow_offload_tuple_dir dir) ++{ ++ __be32 addr, new_addr; ++ ++ switch (dir) { ++ case FLOW_OFFLOAD_DIR_ORIGINAL: ++ addr = iph->daddr; ++ new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_v4.s_addr; ++ iph->daddr = new_addr; ++ break; ++ case FLOW_OFFLOAD_DIR_REPLY: ++ addr = iph->saddr; ++ new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_v4.s_addr; ++ iph->saddr = new_addr; ++ break; ++ default: ++ return -1; ++ } ++ ++ return nf_flow_nat_ip_l4proto(skb, iph, thoff, addr, new_addr); ++} ++ ++static int nf_flow_nat_ip(const struct flow_offload *flow, struct sk_buff *skb, ++ enum flow_offload_tuple_dir dir) ++{ ++ struct iphdr *iph = ip_hdr(skb); ++ unsigned int thoff = iph->ihl * 4; ++ ++ if (flow->flags & FLOW_OFFLOAD_SNAT && ++ (nf_flow_snat_port(flow, skb, thoff, iph->protocol, dir) < 0 || ++ nf_flow_snat_ip(flow, skb, iph, thoff, dir) < 0)) ++ return -1; ++ if (flow->flags & FLOW_OFFLOAD_DNAT && ++ (nf_flow_dnat_port(flow, skb, thoff, iph->protocol, dir) < 0 || ++ nf_flow_dnat_ip(flow, skb, iph, thoff, dir) < 0)) ++ return -1; ++ ++ return 0; ++} ++ ++static bool ip_has_options(unsigned int thoff) ++{ ++ return thoff != sizeof(struct iphdr); ++} ++ ++static int nf_flow_tuple_ip(struct sk_buff *skb, const struct net_device *dev, ++ struct flow_offload_tuple *tuple) ++{ ++ struct flow_ports *ports; ++ unsigned int thoff; ++ struct iphdr *iph; ++ ++ if (!pskb_may_pull(skb, sizeof(*iph))) ++ return -1; ++ ++ iph = ip_hdr(skb); ++ thoff = iph->ihl * 4; ++ ++ if (ip_is_fragment(iph) || ++ unlikely(ip_has_options(thoff))) ++ return -1; ++ ++ if (iph->protocol != IPPROTO_TCP && ++ iph->protocol != IPPROTO_UDP) ++ return -1; ++ ++ thoff = iph->ihl * 4; ++ if (!pskb_may_pull(skb, thoff + sizeof(*ports))) ++ return -1; ++ ++ ports = (struct flow_ports *)(skb_network_header(skb) + thoff); ++ ++ tuple->src_v4.s_addr = iph->saddr; ++ tuple->dst_v4.s_addr = iph->daddr; ++ tuple->src_port = ports->source; ++ tuple->dst_port = ports->dest; ++ tuple->l3proto = AF_INET; ++ tuple->l4proto = iph->protocol; ++ tuple->iifidx = dev->ifindex; ++ ++ return 0; ++} ++ ++/* Based on ip_exceeds_mtu(). */ ++static bool nf_flow_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu) ++{ ++ if (skb->len <= mtu) ++ return false; ++ ++ if ((ip_hdr(skb)->frag_off & htons(IP_DF)) == 0) ++ return false; ++ ++ if (skb_is_gso(skb) && skb_gso_validate_mtu(skb, mtu)) ++ return false; ++ ++ return true; ++} ++ ++unsigned int ++nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb, ++ const struct nf_hook_state *state) ++{ ++ struct flow_offload_tuple_rhash *tuplehash; ++ struct nf_flowtable *flow_table = priv; ++ struct flow_offload_tuple tuple = {}; ++ enum flow_offload_tuple_dir dir; ++ struct flow_offload *flow; ++ struct net_device *outdev; ++ const struct rtable *rt; ++ struct iphdr *iph; ++ __be32 nexthop; ++ ++ if (skb->protocol != htons(ETH_P_IP)) ++ return NF_ACCEPT; ++ ++ if (nf_flow_tuple_ip(skb, state->in, &tuple) < 0) ++ return NF_ACCEPT; ++ ++ tuplehash = flow_offload_lookup(flow_table, &tuple); ++ if (tuplehash == NULL) ++ return NF_ACCEPT; ++ ++ outdev = dev_get_by_index_rcu(state->net, tuplehash->tuple.oifidx); ++ if (!outdev) ++ return NF_ACCEPT; ++ ++ dir = tuplehash->tuple.dir; ++ flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]); ++ rt = (const struct rtable *)flow->tuplehash[dir].tuple.dst_cache; ++ ++ if (unlikely(nf_flow_exceeds_mtu(skb, flow->tuplehash[dir].tuple.mtu))) ++ return NF_ACCEPT; ++ ++ if (skb_try_make_writable(skb, sizeof(*iph))) ++ return NF_DROP; ++ ++ if (flow->flags & (FLOW_OFFLOAD_SNAT | FLOW_OFFLOAD_DNAT) && ++ nf_flow_nat_ip(flow, skb, dir) < 0) ++ return NF_DROP; ++ ++ flow->timeout = (u32)jiffies + NF_FLOW_TIMEOUT; ++ iph = ip_hdr(skb); ++ ip_decrease_ttl(iph); ++ ++ skb->dev = outdev; ++ nexthop = rt_nexthop(rt, flow->tuplehash[!dir].tuple.src_v4.s_addr); ++ neigh_xmit(NEIGH_ARP_TABLE, outdev, &nexthop, skb); ++ ++ return NF_STOLEN; ++} ++EXPORT_SYMBOL_GPL(nf_flow_offload_ip_hook); diff --git a/target/linux/generic/backport-4.19/354-v4.18-netfilter-nf_flow_table-move-ip-header-check-out-of-.patch b/target/linux/generic/backport-4.19/354-v4.18-netfilter-nf_flow_table-move-ip-header-check-out-of-.patch new file mode 100644 index 0000000000..4ee5532438 --- /dev/null +++ b/target/linux/generic/backport-4.19/354-v4.18-netfilter-nf_flow_table-move-ip-header-check-out-of-.patch @@ -0,0 +1,32 @@ +From: Felix Fietkau <nbd@nbd.name> +Date: Sat, 17 Feb 2018 11:51:20 +0100 +Subject: [PATCH] netfilter: nf_flow_table: move ip header check out of + nf_flow_exceeds_mtu + +Allows the function to be shared with the IPv6 hook code + +Signed-off-by: Felix Fietkau <nbd@nbd.name> +--- + +--- a/net/netfilter/nf_flow_table_ip.c ++++ b/net/netfilter/nf_flow_table_ip.c +@@ -181,9 +181,6 @@ static bool nf_flow_exceeds_mtu(const st + if (skb->len <= mtu) + return false; + +- if ((ip_hdr(skb)->frag_off & htons(IP_DF)) == 0) +- return false; +- + if (skb_is_gso(skb) && skb_gso_validate_mtu(skb, mtu)) + return false; + +@@ -222,7 +219,8 @@ nf_flow_offload_ip_hook(void *priv, stru + flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]); + rt = (const struct rtable *)flow->tuplehash[dir].tuple.dst_cache; + +- if (unlikely(nf_flow_exceeds_mtu(skb, flow->tuplehash[dir].tuple.mtu))) ++ if (unlikely(nf_flow_exceeds_mtu(skb, flow->tuplehash[dir].tuple.mtu)) && ++ (ip_hdr(skb)->frag_off & htons(IP_DF)) != 0) + return NF_ACCEPT; + + if (skb_try_make_writable(skb, sizeof(*iph))) diff --git a/target/linux/generic/backport-4.19/355-v4.18-netfilter-nf_flow_table-move-ipv6-offload-hook-code-.patch b/target/linux/generic/backport-4.19/355-v4.18-netfilter-nf_flow_table-move-ipv6-offload-hook-code-.patch new file mode 100644 index 0000000000..20ab0ed504 --- /dev/null +++ b/target/linux/generic/backport-4.19/355-v4.18-netfilter-nf_flow_table-move-ipv6-offload-hook-code-.patch @@ -0,0 +1,483 @@ +From: Felix Fietkau <nbd@nbd.name> +Date: Sat, 17 Feb 2018 11:55:51 +0100 +Subject: [PATCH] netfilter: nf_flow_table: move ipv6 offload hook code to + nf_flow_table + +Useful as preparation for adding iptables support for offload + +Signed-off-by: Felix Fietkau <nbd@nbd.name> +--- + +--- a/net/ipv6/netfilter/nf_flow_table_ipv6.c ++++ b/net/ipv6/netfilter/nf_flow_table_ipv6.c +@@ -3,240 +3,8 @@ + #include <linux/module.h> + #include <linux/netfilter.h> + #include <linux/rhashtable.h> +-#include <linux/ipv6.h> +-#include <linux/netdevice.h> +-#include <net/ipv6.h> +-#include <net/ip6_route.h> +-#include <net/neighbour.h> + #include <net/netfilter/nf_flow_table.h> + #include <net/netfilter/nf_tables.h> +-/* For layer 4 checksum field offset. */ +-#include <linux/tcp.h> +-#include <linux/udp.h> +- +-static int nf_flow_nat_ipv6_tcp(struct sk_buff *skb, unsigned int thoff, +- struct in6_addr *addr, +- struct in6_addr *new_addr) +-{ +- struct tcphdr *tcph; +- +- if (!pskb_may_pull(skb, thoff + sizeof(*tcph)) || +- skb_try_make_writable(skb, thoff + sizeof(*tcph))) +- return -1; +- +- tcph = (void *)(skb_network_header(skb) + thoff); +- inet_proto_csum_replace16(&tcph->check, skb, addr->s6_addr32, +- new_addr->s6_addr32, true); +- +- return 0; +-} +- +-static int nf_flow_nat_ipv6_udp(struct sk_buff *skb, unsigned int thoff, +- struct in6_addr *addr, +- struct in6_addr *new_addr) +-{ +- struct udphdr *udph; +- +- if (!pskb_may_pull(skb, thoff + sizeof(*udph)) || +- skb_try_make_writable(skb, thoff + sizeof(*udph))) +- return -1; +- +- udph = (void *)(skb_network_header(skb) + thoff); +- if (udph->check || skb->ip_summed == CHECKSUM_PARTIAL) { +- inet_proto_csum_replace16(&udph->check, skb, addr->s6_addr32, +- new_addr->s6_addr32, true); +- if (!udph->check) +- udph->check = CSUM_MANGLED_0; +- } +- +- return 0; +-} +- +-static int nf_flow_nat_ipv6_l4proto(struct sk_buff *skb, struct ipv6hdr *ip6h, +- unsigned int thoff, struct in6_addr *addr, +- struct in6_addr *new_addr) +-{ +- switch (ip6h->nexthdr) { +- case IPPROTO_TCP: +- if (nf_flow_nat_ipv6_tcp(skb, thoff, addr, new_addr) < 0) +- return NF_DROP; +- break; +- case IPPROTO_UDP: +- if (nf_flow_nat_ipv6_udp(skb, thoff, addr, new_addr) < 0) +- return NF_DROP; +- break; +- } +- +- return 0; +-} +- +-static int nf_flow_snat_ipv6(const struct flow_offload *flow, +- struct sk_buff *skb, struct ipv6hdr *ip6h, +- unsigned int thoff, +- enum flow_offload_tuple_dir dir) +-{ +- struct in6_addr addr, new_addr; +- +- switch (dir) { +- case FLOW_OFFLOAD_DIR_ORIGINAL: +- addr = ip6h->saddr; +- new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_v6; +- ip6h->saddr = new_addr; +- break; +- case FLOW_OFFLOAD_DIR_REPLY: +- addr = ip6h->daddr; +- new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_v6; +- ip6h->daddr = new_addr; +- break; +- default: +- return -1; +- } +- +- return nf_flow_nat_ipv6_l4proto(skb, ip6h, thoff, &addr, &new_addr); +-} +- +-static int nf_flow_dnat_ipv6(const struct flow_offload *flow, +- struct sk_buff *skb, struct ipv6hdr *ip6h, +- unsigned int thoff, +- enum flow_offload_tuple_dir dir) +-{ +- struct in6_addr addr, new_addr; +- +- switch (dir) { +- case FLOW_OFFLOAD_DIR_ORIGINAL: +- addr = ip6h->daddr; +- new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_v6; +- ip6h->daddr = new_addr; +- break; +- case FLOW_OFFLOAD_DIR_REPLY: +- addr = ip6h->saddr; +- new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_v6; +- ip6h->saddr = new_addr; +- break; +- default: +- return -1; +- } +- +- return nf_flow_nat_ipv6_l4proto(skb, ip6h, thoff, &addr, &new_addr); +-} +- +-static int nf_flow_nat_ipv6(const struct flow_offload *flow, +- struct sk_buff *skb, +- enum flow_offload_tuple_dir dir) +-{ +- struct ipv6hdr *ip6h = ipv6_hdr(skb); +- unsigned int thoff = sizeof(*ip6h); +- +- if (flow->flags & FLOW_OFFLOAD_SNAT && +- (nf_flow_snat_port(flow, skb, thoff, ip6h->nexthdr, dir) < 0 || +- nf_flow_snat_ipv6(flow, skb, ip6h, thoff, dir) < 0)) +- return -1; +- if (flow->flags & FLOW_OFFLOAD_DNAT && +- (nf_flow_dnat_port(flow, skb, thoff, ip6h->nexthdr, dir) < 0 || +- nf_flow_dnat_ipv6(flow, skb, ip6h, thoff, dir) < 0)) +- return -1; +- +- return 0; +-} +- +-static int nf_flow_tuple_ipv6(struct sk_buff *skb, const struct net_device *dev, +- struct flow_offload_tuple *tuple) +-{ +- struct flow_ports *ports; +- struct ipv6hdr *ip6h; +- unsigned int thoff; +- +- if (!pskb_may_pull(skb, sizeof(*ip6h))) +- return -1; +- +- ip6h = ipv6_hdr(skb); +- +- if (ip6h->nexthdr != IPPROTO_TCP && +- ip6h->nexthdr != IPPROTO_UDP) +- return -1; +- +- thoff = sizeof(*ip6h); +- if (!pskb_may_pull(skb, thoff + sizeof(*ports))) +- return -1; +- +- ports = (struct flow_ports *)(skb_network_header(skb) + thoff); +- +- tuple->src_v6 = ip6h->saddr; +- tuple->dst_v6 = ip6h->daddr; +- tuple->src_port = ports->source; +- tuple->dst_port = ports->dest; +- tuple->l3proto = AF_INET6; +- tuple->l4proto = ip6h->nexthdr; +- tuple->iifidx = dev->ifindex; +- +- return 0; +-} +- +-/* Based on ip_exceeds_mtu(). */ +-static bool nf_flow_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu) +-{ +- if (skb->len <= mtu) +- return false; +- +- if (skb_is_gso(skb) && skb_gso_validate_mtu(skb, mtu)) +- return false; +- +- return true; +-} +- +-unsigned int +-nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb, +- const struct nf_hook_state *state) +-{ +- struct flow_offload_tuple_rhash *tuplehash; +- struct nf_flowtable *flow_table = priv; +- struct flow_offload_tuple tuple = {}; +- enum flow_offload_tuple_dir dir; +- struct flow_offload *flow; +- struct net_device *outdev; +- struct in6_addr *nexthop; +- struct ipv6hdr *ip6h; +- struct rt6_info *rt; +- +- if (skb->protocol != htons(ETH_P_IPV6)) +- return NF_ACCEPT; +- +- if (nf_flow_tuple_ipv6(skb, state->in, &tuple) < 0) +- return NF_ACCEPT; +- +- tuplehash = flow_offload_lookup(flow_table, &tuple); +- if (tuplehash == NULL) +- return NF_ACCEPT; +- +- outdev = dev_get_by_index_rcu(state->net, tuplehash->tuple.oifidx); +- if (!outdev) +- return NF_ACCEPT; +- +- dir = tuplehash->tuple.dir; +- flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]); +- rt = (struct rt6_info *)flow->tuplehash[dir].tuple.dst_cache; +- +- if (unlikely(nf_flow_exceeds_mtu(skb, flow->tuplehash[dir].tuple.mtu))) +- return NF_ACCEPT; +- +- if (skb_try_make_writable(skb, sizeof(*ip6h))) +- return NF_DROP; +- +- if (flow->flags & (FLOW_OFFLOAD_SNAT | FLOW_OFFLOAD_DNAT) && +- nf_flow_nat_ipv6(flow, skb, dir) < 0) +- return NF_DROP; +- +- flow->timeout = (u32)jiffies + NF_FLOW_TIMEOUT; +- ip6h = ipv6_hdr(skb); +- ip6h->hop_limit--; +- +- skb->dev = outdev; +- nexthop = rt6_nexthop(rt, &flow->tuplehash[!dir].tuple.src_v6); +- neigh_xmit(NEIGH_ND_TABLE, outdev, nexthop, skb); +- +- return NF_STOLEN; +-} +-EXPORT_SYMBOL_GPL(nf_flow_offload_ipv6_hook); + + static struct nf_flowtable_type flowtable_ipv6 = { + .family = NFPROTO_IPV6, +--- a/net/netfilter/nf_flow_table_ip.c ++++ b/net/netfilter/nf_flow_table_ip.c +@@ -4,8 +4,11 @@ + #include <linux/netfilter.h> + #include <linux/rhashtable.h> + #include <linux/ip.h> ++#include <linux/ipv6.h> + #include <linux/netdevice.h> + #include <net/ip.h> ++#include <net/ipv6.h> ++#include <net/ip6_route.h> + #include <net/neighbour.h> + #include <net/netfilter/nf_flow_table.h> + /* For layer 4 checksum field offset. */ +@@ -241,3 +244,215 @@ nf_flow_offload_ip_hook(void *priv, stru + return NF_STOLEN; + } + EXPORT_SYMBOL_GPL(nf_flow_offload_ip_hook); ++ ++static int nf_flow_nat_ipv6_tcp(struct sk_buff *skb, unsigned int thoff, ++ struct in6_addr *addr, ++ struct in6_addr *new_addr) ++{ ++ struct tcphdr *tcph; ++ ++ if (!pskb_may_pull(skb, thoff + sizeof(*tcph)) || ++ skb_try_make_writable(skb, thoff + sizeof(*tcph))) ++ return -1; ++ ++ tcph = (void *)(skb_network_header(skb) + thoff); ++ inet_proto_csum_replace16(&tcph->check, skb, addr->s6_addr32, ++ new_addr->s6_addr32, true); ++ ++ return 0; ++} ++ ++static int nf_flow_nat_ipv6_udp(struct sk_buff *skb, unsigned int thoff, ++ struct in6_addr *addr, ++ struct in6_addr *new_addr) ++{ ++ struct udphdr *udph; ++ ++ if (!pskb_may_pull(skb, thoff + sizeof(*udph)) || ++ skb_try_make_writable(skb, thoff + sizeof(*udph))) ++ return -1; ++ ++ udph = (void *)(skb_network_header(skb) + thoff); ++ if (udph->check || skb->ip_summed == CHECKSUM_PARTIAL) { ++ inet_proto_csum_replace16(&udph->check, skb, addr->s6_addr32, ++ new_addr->s6_addr32, true); ++ if (!udph->check) ++ udph->check = CSUM_MANGLED_0; ++ } ++ ++ return 0; ++} ++ ++static int nf_flow_nat_ipv6_l4proto(struct sk_buff *skb, struct ipv6hdr *ip6h, ++ unsigned int thoff, struct in6_addr *addr, ++ struct in6_addr *new_addr) ++{ ++ switch (ip6h->nexthdr) { ++ case IPPROTO_TCP: ++ if (nf_flow_nat_ipv6_tcp(skb, thoff, addr, new_addr) < 0) ++ return NF_DROP; ++ break; ++ case IPPROTO_UDP: ++ if (nf_flow_nat_ipv6_udp(skb, thoff, addr, new_addr) < 0) ++ return NF_DROP; ++ break; ++ } ++ ++ return 0; ++} ++ ++static int nf_flow_snat_ipv6(const struct flow_offload *flow, ++ struct sk_buff *skb, struct ipv6hdr *ip6h, ++ unsigned int thoff, ++ enum flow_offload_tuple_dir dir) ++{ ++ struct in6_addr addr, new_addr; ++ ++ switch (dir) { ++ case FLOW_OFFLOAD_DIR_ORIGINAL: ++ addr = ip6h->saddr; ++ new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_v6; ++ ip6h->saddr = new_addr; ++ break; ++ case FLOW_OFFLOAD_DIR_REPLY: ++ addr = ip6h->daddr; ++ new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_v6; ++ ip6h->daddr = new_addr; ++ break; ++ default: ++ return -1; ++ } ++ ++ return nf_flow_nat_ipv6_l4proto(skb, ip6h, thoff, &addr, &new_addr); ++} ++ ++static int nf_flow_dnat_ipv6(const struct flow_offload *flow, ++ struct sk_buff *skb, struct ipv6hdr *ip6h, ++ unsigned int thoff, ++ enum flow_offload_tuple_dir dir) ++{ ++ struct in6_addr addr, new_addr; ++ ++ switch (dir) { ++ case FLOW_OFFLOAD_DIR_ORIGINAL: ++ addr = ip6h->daddr; ++ new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_v6; ++ ip6h->daddr = new_addr; ++ break; ++ case FLOW_OFFLOAD_DIR_REPLY: ++ addr = ip6h->saddr; ++ new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_v6; ++ ip6h->saddr = new_addr; ++ break; ++ default: ++ return -1; ++ } ++ ++ return nf_flow_nat_ipv6_l4proto(skb, ip6h, thoff, &addr, &new_addr); ++} ++ ++static int nf_flow_nat_ipv6(const struct flow_offload *flow, ++ struct sk_buff *skb, ++ enum flow_offload_tuple_dir dir) ++{ ++ struct ipv6hdr *ip6h = ipv6_hdr(skb); ++ unsigned int thoff = sizeof(*ip6h); ++ ++ if (flow->flags & FLOW_OFFLOAD_SNAT && ++ (nf_flow_snat_port(flow, skb, thoff, ip6h->nexthdr, dir) < 0 || ++ nf_flow_snat_ipv6(flow, skb, ip6h, thoff, dir) < 0)) ++ return -1; ++ if (flow->flags & FLOW_OFFLOAD_DNAT && ++ (nf_flow_dnat_port(flow, skb, thoff, ip6h->nexthdr, dir) < 0 || ++ nf_flow_dnat_ipv6(flow, skb, ip6h, thoff, dir) < 0)) ++ return -1; ++ ++ return 0; ++} ++ ++static int nf_flow_tuple_ipv6(struct sk_buff *skb, const struct net_device *dev, ++ struct flow_offload_tuple *tuple) ++{ ++ struct flow_ports *ports; ++ struct ipv6hdr *ip6h; ++ unsigned int thoff; ++ ++ if (!pskb_may_pull(skb, sizeof(*ip6h))) ++ return -1; ++ ++ ip6h = ipv6_hdr(skb); ++ ++ if (ip6h->nexthdr != IPPROTO_TCP && ++ ip6h->nexthdr != IPPROTO_UDP) ++ return -1; ++ ++ thoff = sizeof(*ip6h); ++ if (!pskb_may_pull(skb, thoff + sizeof(*ports))) ++ return -1; ++ ++ ports = (struct flow_ports *)(skb_network_header(skb) + thoff); ++ ++ tuple->src_v6 = ip6h->saddr; ++ tuple->dst_v6 = ip6h->daddr; ++ tuple->src_port = ports->source; ++ tuple->dst_port = ports->dest; ++ tuple->l3proto = AF_INET6; ++ tuple->l4proto = ip6h->nexthdr; ++ tuple->iifidx = dev->ifindex; ++ ++ return 0; ++} ++ ++unsigned int ++nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb, ++ const struct nf_hook_state *state) ++{ ++ struct flow_offload_tuple_rhash *tuplehash; ++ struct nf_flowtable *flow_table = priv; ++ struct flow_offload_tuple tuple = {}; ++ enum flow_offload_tuple_dir dir; ++ struct flow_offload *flow; ++ struct net_device *outdev; ++ struct in6_addr *nexthop; ++ struct ipv6hdr *ip6h; ++ struct rt6_info *rt; ++ ++ if (skb->protocol != htons(ETH_P_IPV6)) ++ return NF_ACCEPT; ++ ++ if (nf_flow_tuple_ipv6(skb, state->in, &tuple) < 0) ++ return NF_ACCEPT; ++ ++ tuplehash = flow_offload_lookup(flow_table, &tuple); ++ if (tuplehash == NULL) ++ return NF_ACCEPT; ++ ++ outdev = dev_get_by_index_rcu(state->net, tuplehash->tuple.oifidx); ++ if (!outdev) ++ return NF_ACCEPT; ++ ++ dir = tuplehash->tuple.dir; ++ flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]); ++ rt = (struct rt6_info *)flow->tuplehash[dir].tuple.dst_cache; ++ ++ if (unlikely(nf_flow_exceeds_mtu(skb, flow->tuplehash[dir].tuple.mtu))) ++ return NF_ACCEPT; ++ ++ if (skb_try_make_writable(skb, sizeof(*ip6h))) ++ return NF_DROP; ++ ++ if (flow->flags & (FLOW_OFFLOAD_SNAT | FLOW_OFFLOAD_DNAT) && ++ nf_flow_nat_ipv6(flow, skb, dir) < 0) ++ return NF_DROP; ++ ++ flow->timeout = (u32)jiffies + NF_FLOW_TIMEOUT; ++ ip6h = ipv6_hdr(skb); ++ ip6h->hop_limit--; ++ ++ skb->dev = outdev; ++ nexthop = rt6_nexthop(rt, &flow->tuplehash[!dir].tuple.src_v6); ++ neigh_xmit(NEIGH_ND_TABLE, outdev, nexthop, skb); ++ ++ return NF_STOLEN; ++} ++EXPORT_SYMBOL_GPL(nf_flow_offload_ipv6_hook); diff --git a/target/linux/generic/backport-4.19/356-v4.18-netfilter-nf_flow_table-relax-mixed-ipv4-ipv6-flowta.patch b/target/linux/generic/backport-4.19/356-v4.18-netfilter-nf_flow_table-relax-mixed-ipv4-ipv6-flowta.patch new file mode 100644 index 0000000000..b5fe25a1d6 --- /dev/null +++ b/target/linux/generic/backport-4.19/356-v4.18-netfilter-nf_flow_table-relax-mixed-ipv4-ipv6-flowta.patch @@ -0,0 +1,23 @@ +From: Felix Fietkau <nbd@nbd.name> +Date: Sat, 17 Feb 2018 12:02:28 +0100 +Subject: [PATCH] netfilter: nf_flow_table: relax mixed ipv4/ipv6 flowtable + dependencies + +Since the offload hook code was moved, this table no longer depends on +the IPv4 and IPv6 flowtable modules + +Signed-off-by: Felix Fietkau <nbd@nbd.name> +--- + +--- a/net/netfilter/Kconfig ++++ b/net/netfilter/Kconfig +@@ -676,8 +676,7 @@ endif # NF_TABLES + + config NF_FLOW_TABLE_INET + tristate "Netfilter flow table mixed IPv4/IPv6 module" +- depends on NF_FLOW_TABLE_IPV4 +- depends on NF_FLOW_TABLE_IPV6 ++ depends on NF_FLOW_TABLE + help + This option adds the flow table mixed IPv4/IPv6 support. + diff --git a/target/linux/generic/backport-4.19/357-v4.18-netfilter-nf_flow_table-move-init-code-to-nf_flow_ta.patch b/target/linux/generic/backport-4.19/357-v4.18-netfilter-nf_flow_table-move-init-code-to-nf_flow_ta.patch new file mode 100644 index 0000000000..2cf8cea23c --- /dev/null +++ b/target/linux/generic/backport-4.19/357-v4.18-netfilter-nf_flow_table-move-init-code-to-nf_flow_ta.patch @@ -0,0 +1,298 @@ +From: Felix Fietkau <nbd@nbd.name> +Date: Sun, 18 Feb 2018 18:16:31 +0100 +Subject: [PATCH] netfilter: nf_flow_table: move init code to + nf_flow_table_core.c + +Reduces duplication of .gc and .params in flowtable type definitions and +makes the API clearer + +Signed-off-by: Felix Fietkau <nbd@nbd.name> +--- + +--- a/include/net/netfilter/nf_flow_table.h ++++ b/include/net/netfilter/nf_flow_table.h +@@ -14,9 +14,8 @@ struct nf_flowtable; + struct nf_flowtable_type { + struct list_head list; + int family; +- void (*gc)(struct work_struct *work); ++ int (*init)(struct nf_flowtable *ft); + void (*free)(struct nf_flowtable *ft); +- const struct rhashtable_params *params; + nf_hookfn *hook; + struct module *owner; + }; +@@ -100,9 +99,8 @@ int nf_flow_table_iterate(struct nf_flow + + void nf_flow_table_cleanup(struct net *net, struct net_device *dev); + ++int nf_flow_table_init(struct nf_flowtable *flow_table); + void nf_flow_table_free(struct nf_flowtable *flow_table); +-void nf_flow_offload_work_gc(struct work_struct *work); +-extern const struct rhashtable_params nf_flow_offload_rhash_params; + + void flow_offload_dead(struct flow_offload *flow); + +--- a/net/ipv4/netfilter/nf_flow_table_ipv4.c ++++ b/net/ipv4/netfilter/nf_flow_table_ipv4.c +@@ -7,8 +7,7 @@ + + static struct nf_flowtable_type flowtable_ipv4 = { + .family = NFPROTO_IPV4, +- .params = &nf_flow_offload_rhash_params, +- .gc = nf_flow_offload_work_gc, ++ .init = nf_flow_table_init, + .free = nf_flow_table_free, + .hook = nf_flow_offload_ip_hook, + .owner = THIS_MODULE, +--- a/net/ipv6/netfilter/nf_flow_table_ipv6.c ++++ b/net/ipv6/netfilter/nf_flow_table_ipv6.c +@@ -8,8 +8,7 @@ + + static struct nf_flowtable_type flowtable_ipv6 = { + .family = NFPROTO_IPV6, +- .params = &nf_flow_offload_rhash_params, +- .gc = nf_flow_offload_work_gc, ++ .init = nf_flow_table_init, + .free = nf_flow_table_free, + .hook = nf_flow_offload_ipv6_hook, + .owner = THIS_MODULE, +--- a/net/netfilter/nf_flow_table_core.c ++++ b/net/netfilter/nf_flow_table_core.c +@@ -116,16 +116,50 @@ void flow_offload_dead(struct flow_offlo + } + EXPORT_SYMBOL_GPL(flow_offload_dead); + ++static u32 flow_offload_hash(const void *data, u32 len, u32 seed) ++{ ++ const struct flow_offload_tuple *tuple = data; ++ ++ return jhash(tuple, offsetof(struct flow_offload_tuple, dir), seed); ++} ++ ++static u32 flow_offload_hash_obj(const void *data, u32 len, u32 seed) ++{ ++ const struct flow_offload_tuple_rhash *tuplehash = data; ++ ++ return jhash(&tuplehash->tuple, offsetof(struct flow_offload_tuple, dir), seed); ++} ++ ++static int flow_offload_hash_cmp(struct rhashtable_compare_arg *arg, ++ const void *ptr) ++{ ++ const struct flow_offload_tuple *tuple = arg->key; ++ const struct flow_offload_tuple_rhash *x = ptr; ++ ++ if (memcmp(&x->tuple, tuple, offsetof(struct flow_offload_tuple, dir))) ++ return 1; ++ ++ return 0; ++} ++ ++static const struct rhashtable_params nf_flow_offload_rhash_params = { ++ .head_offset = offsetof(struct flow_offload_tuple_rhash, node), ++ .hashfn = flow_offload_hash, ++ .obj_hashfn = flow_offload_hash_obj, ++ .obj_cmpfn = flow_offload_hash_cmp, ++ .automatic_shrinking = true, ++}; ++ + int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow) + { + flow->timeout = (u32)jiffies; + + rhashtable_insert_fast(&flow_table->rhashtable, + &flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].node, +- *flow_table->type->params); ++ nf_flow_offload_rhash_params); + rhashtable_insert_fast(&flow_table->rhashtable, + &flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].node, +- *flow_table->type->params); ++ nf_flow_offload_rhash_params); + return 0; + } + EXPORT_SYMBOL_GPL(flow_offload_add); +@@ -135,10 +169,10 @@ static void flow_offload_del(struct nf_f + { + rhashtable_remove_fast(&flow_table->rhashtable, + &flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].node, +- *flow_table->type->params); ++ nf_flow_offload_rhash_params); + rhashtable_remove_fast(&flow_table->rhashtable, + &flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].node, +- *flow_table->type->params); ++ nf_flow_offload_rhash_params); + + flow_offload_free(flow); + } +@@ -148,7 +182,7 @@ flow_offload_lookup(struct nf_flowtable + struct flow_offload_tuple *tuple) + { + return rhashtable_lookup_fast(&flow_table->rhashtable, tuple, +- *flow_table->type->params); ++ nf_flow_offload_rhash_params); + } + EXPORT_SYMBOL_GPL(flow_offload_lookup); + +@@ -237,7 +271,7 @@ out: + return 1; + } + +-void nf_flow_offload_work_gc(struct work_struct *work) ++static void nf_flow_offload_work_gc(struct work_struct *work) + { + struct nf_flowtable *flow_table; + +@@ -245,42 +279,6 @@ void nf_flow_offload_work_gc(struct work + nf_flow_offload_gc_step(flow_table); + queue_delayed_work(system_power_efficient_wq, &flow_table->gc_work, HZ); + } +-EXPORT_SYMBOL_GPL(nf_flow_offload_work_gc); +- +-static u32 flow_offload_hash(const void *data, u32 len, u32 seed) +-{ +- const struct flow_offload_tuple *tuple = data; +- +- return jhash(tuple, offsetof(struct flow_offload_tuple, dir), seed); +-} +- +-static u32 flow_offload_hash_obj(const void *data, u32 len, u32 seed) +-{ +- const struct flow_offload_tuple_rhash *tuplehash = data; +- +- return jhash(&tuplehash->tuple, offsetof(struct flow_offload_tuple, dir), seed); +-} +- +-static int flow_offload_hash_cmp(struct rhashtable_compare_arg *arg, +- const void *ptr) +-{ +- const struct flow_offload_tuple *tuple = arg->key; +- const struct flow_offload_tuple_rhash *x = ptr; +- +- if (memcmp(&x->tuple, tuple, offsetof(struct flow_offload_tuple, dir))) +- return 1; +- +- return 0; +-} +- +-const struct rhashtable_params nf_flow_offload_rhash_params = { +- .head_offset = offsetof(struct flow_offload_tuple_rhash, node), +- .hashfn = flow_offload_hash, +- .obj_hashfn = flow_offload_hash_obj, +- .obj_cmpfn = flow_offload_hash_cmp, +- .automatic_shrinking = true, +-}; +-EXPORT_SYMBOL_GPL(nf_flow_offload_rhash_params); + + static int nf_flow_nat_port_tcp(struct sk_buff *skb, unsigned int thoff, + __be16 port, __be16 new_port) +@@ -398,6 +396,24 @@ int nf_flow_dnat_port(const struct flow_ + } + EXPORT_SYMBOL_GPL(nf_flow_dnat_port); + ++int nf_flow_table_init(struct nf_flowtable *flowtable) ++{ ++ int err; ++ ++ INIT_DEFERRABLE_WORK(&flowtable->gc_work, nf_flow_offload_work_gc); ++ ++ err = rhashtable_init(&flowtable->rhashtable, ++ &nf_flow_offload_rhash_params); ++ if (err < 0) ++ return err; ++ ++ queue_delayed_work(system_power_efficient_wq, ++ &flowtable->gc_work, HZ); ++ ++ return 0; ++} ++EXPORT_SYMBOL_GPL(nf_flow_table_init); ++ + static void nf_flow_table_do_cleanup(struct flow_offload *flow, void *data) + { + struct net_device *dev = data; +@@ -423,8 +439,10 @@ EXPORT_SYMBOL_GPL(nf_flow_table_cleanup) + + void nf_flow_table_free(struct nf_flowtable *flow_table) + { ++ cancel_delayed_work_sync(&flow_table->gc_work); + nf_flow_table_iterate(flow_table, nf_flow_table_do_cleanup, NULL); + WARN_ON(!nf_flow_offload_gc_step(flow_table)); ++ rhashtable_destroy(&flow_table->rhashtable); + } + EXPORT_SYMBOL_GPL(nf_flow_table_free); + +--- a/net/netfilter/nf_flow_table_inet.c ++++ b/net/netfilter/nf_flow_table_inet.c +@@ -22,8 +22,7 @@ nf_flow_offload_inet_hook(void *priv, st + + static struct nf_flowtable_type flowtable_inet = { + .family = NFPROTO_INET, +- .params = &nf_flow_offload_rhash_params, +- .gc = nf_flow_offload_work_gc, ++ .init = nf_flow_table_init, + .free = nf_flow_table_free, + .hook = nf_flow_offload_inet_hook, + .owner = THIS_MODULE, +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -5081,40 +5081,38 @@ static int nf_tables_newflowtable(struct + } + + flowtable->data.type = type; +- err = rhashtable_init(&flowtable->data.rhashtable, type->params); ++ err = type->init(&flowtable->data); + if (err < 0) + goto err3; + + err = nf_tables_flowtable_parse_hook(&ctx, nla[NFTA_FLOWTABLE_HOOK], + flowtable); + if (err < 0) +- goto err3; ++ goto err4; + + for (i = 0; i < flowtable->ops_len; i++) { + err = nf_register_net_hook(net, &flowtable->ops[i]); + if (err < 0) +- goto err4; ++ goto err5; + } + + err = nft_trans_flowtable_add(&ctx, NFT_MSG_NEWFLOWTABLE, flowtable); + if (err < 0) +- goto err5; +- +- INIT_DEFERRABLE_WORK(&flowtable->data.gc_work, type->gc); +- queue_delayed_work(system_power_efficient_wq, +- &flowtable->data.gc_work, HZ); ++ goto err6; + + list_add_tail_rcu(&flowtable->list, &table->flowtables); + table->use++; + + return 0; +-err5: ++err6: + i = flowtable->ops_len; +-err4: ++err5: + for (k = i - 1; k >= 0; k--) + nf_unregister_net_hook(net, &flowtable->ops[i]); + + kfree(flowtable->ops); ++err4: ++ flowtable->data.type->free(&flowtable->data); + err3: + module_put(type->owner); + err2: +@@ -5395,10 +5393,8 @@ err: + + static void nf_tables_flowtable_destroy(struct nft_flowtable *flowtable) + { +- cancel_delayed_work_sync(&flowtable->data.gc_work); + kfree(flowtable->name); + flowtable->data.type->free(&flowtable->data); +- rhashtable_destroy(&flowtable->data.rhashtable); + module_put(flowtable->data.type->owner); + } + diff --git a/target/linux/generic/backport-4.19/358-v4.18-netfilter-nf_flow_table-fix-priv-pointer-for-netdev-.patch b/target/linux/generic/backport-4.19/358-v4.18-netfilter-nf_flow_table-fix-priv-pointer-for-netdev-.patch new file mode 100644 index 0000000000..d978a076fd --- /dev/null +++ b/target/linux/generic/backport-4.19/358-v4.18-netfilter-nf_flow_table-fix-priv-pointer-for-netdev-.patch @@ -0,0 +1,22 @@ +From: Felix Fietkau <nbd@nbd.name> +Date: Tue, 20 Feb 2018 14:48:51 +0100 +Subject: [PATCH] netfilter: nf_flow_table: fix priv pointer for netdev hook + +The offload ip hook expects a pointer to the flowtable, not to the +rhashtable. Since the rhashtable is the first member, this is safe for +the moment, but breaks as soon as the structure layout changes + +Signed-off-by: Felix Fietkau <nbd@nbd.name> +--- + +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -4947,7 +4947,7 @@ static int nf_tables_flowtable_parse_hoo + flowtable->ops[i].pf = NFPROTO_NETDEV; + flowtable->ops[i].hooknum = hooknum; + flowtable->ops[i].priority = priority; +- flowtable->ops[i].priv = &flowtable->data.rhashtable; ++ flowtable->ops[i].priv = &flowtable->data; + flowtable->ops[i].hook = flowtable->data.type->hook; + flowtable->ops[i].dev = dev_array[i]; + } diff --git a/target/linux/generic/backport-4.19/359-v4.18-netfilter-nf_flow_table-track-flow-tables-in-nf_flow.patch b/target/linux/generic/backport-4.19/359-v4.18-netfilter-nf_flow_table-track-flow-tables-in-nf_flow.patch new file mode 100644 index 0000000000..84048a0be8 --- /dev/null +++ b/target/linux/generic/backport-4.19/359-v4.18-netfilter-nf_flow_table-track-flow-tables-in-nf_flow.patch @@ -0,0 +1,114 @@ +From: Felix Fietkau <nbd@nbd.name> +Date: Tue, 20 Feb 2018 14:08:14 +0100 +Subject: [PATCH] netfilter: nf_flow_table: track flow tables in nf_flow_table + directly + +Avoids having nf_flow_table depend on nftables (useful for future +iptables backport work) + +Signed-off-by: Felix Fietkau <nbd@nbd.name> +--- + +--- a/include/net/netfilter/nf_flow_table.h ++++ b/include/net/netfilter/nf_flow_table.h +@@ -21,6 +21,7 @@ struct nf_flowtable_type { + }; + + struct nf_flowtable { ++ struct list_head list; + struct rhashtable rhashtable; + const struct nf_flowtable_type *type; + struct delayed_work gc_work; +--- a/include/net/netfilter/nf_tables.h ++++ b/include/net/netfilter/nf_tables.h +@@ -1096,9 +1096,6 @@ struct nft_flowtable { + struct nft_flowtable *nf_tables_flowtable_lookup(const struct nft_table *table, + const struct nlattr *nla, + u8 genmask); +-void nft_flow_table_iterate(struct net *net, +- void (*iter)(struct nf_flowtable *flowtable, void *data), +- void *data); + + void nft_register_flowtable_type(struct nf_flowtable_type *type); + void nft_unregister_flowtable_type(struct nf_flowtable_type *type); +--- a/net/netfilter/nf_flow_table_core.c ++++ b/net/netfilter/nf_flow_table_core.c +@@ -18,6 +18,9 @@ struct flow_offload_entry { + struct rcu_head rcu_head; + }; + ++static DEFINE_MUTEX(flowtable_lock); ++static LIST_HEAD(flowtables); ++ + static void + flow_offload_fill_dir(struct flow_offload *flow, struct nf_conn *ct, + struct nf_flow_route *route, +@@ -410,6 +413,10 @@ int nf_flow_table_init(struct nf_flowtab + queue_delayed_work(system_power_efficient_wq, + &flowtable->gc_work, HZ); + ++ mutex_lock(&flowtable_lock); ++ list_add(&flowtable->list, &flowtables); ++ mutex_unlock(&flowtable_lock); ++ + return 0; + } + EXPORT_SYMBOL_GPL(nf_flow_table_init); +@@ -425,20 +432,28 @@ static void nf_flow_table_do_cleanup(str + } + + static void nf_flow_table_iterate_cleanup(struct nf_flowtable *flowtable, +- void *data) ++ struct net_device *dev) + { +- nf_flow_table_iterate(flowtable, nf_flow_table_do_cleanup, data); ++ nf_flow_table_iterate(flowtable, nf_flow_table_do_cleanup, dev); + flush_delayed_work(&flowtable->gc_work); + } + + void nf_flow_table_cleanup(struct net *net, struct net_device *dev) + { +- nft_flow_table_iterate(net, nf_flow_table_iterate_cleanup, dev); ++ struct nf_flowtable *flowtable; ++ ++ mutex_lock(&flowtable_lock); ++ list_for_each_entry(flowtable, &flowtables, list) ++ nf_flow_table_iterate_cleanup(flowtable, dev); ++ mutex_unlock(&flowtable_lock); + } + EXPORT_SYMBOL_GPL(nf_flow_table_cleanup); + + void nf_flow_table_free(struct nf_flowtable *flow_table) + { ++ mutex_lock(&flowtable_lock); ++ list_del(&flow_table->list); ++ mutex_unlock(&flowtable_lock); + cancel_delayed_work_sync(&flow_table->gc_work); + nf_flow_table_iterate(flow_table, nf_flow_table_do_cleanup, NULL); + WARN_ON(!nf_flow_offload_gc_step(flow_table)); +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -4991,23 +4991,6 @@ static const struct nf_flowtable_type *n + return ERR_PTR(-ENOENT); + } + +-void nft_flow_table_iterate(struct net *net, +- void (*iter)(struct nf_flowtable *flowtable, void *data), +- void *data) +-{ +- struct nft_flowtable *flowtable; +- const struct nft_table *table; +- +- nfnl_lock(NFNL_SUBSYS_NFTABLES); +- list_for_each_entry(table, &net->nft.tables, list) { +- list_for_each_entry(flowtable, &table->flowtables, list) { +- iter(&flowtable->data, data); +- } +- } +- nfnl_unlock(NFNL_SUBSYS_NFTABLES); +-} +-EXPORT_SYMBOL_GPL(nft_flow_table_iterate); +- + static void nft_unregister_flowtable_net_hooks(struct net *net, + struct nft_flowtable *flowtable) + { diff --git a/target/linux/generic/backport-4.19/360-v4.18-netfilter-nf_flow_table-make-flow_offload_dead-inlin.patch b/target/linux/generic/backport-4.19/360-v4.18-netfilter-nf_flow_table-make-flow_offload_dead-inlin.patch new file mode 100644 index 0000000000..d33400c729 --- /dev/null +++ b/target/linux/generic/backport-4.19/360-v4.18-netfilter-nf_flow_table-make-flow_offload_dead-inlin.patch @@ -0,0 +1,38 @@ +From: Felix Fietkau <nbd@nbd.name> +Date: Sun, 25 Feb 2018 15:37:27 +0100 +Subject: [PATCH] netfilter: nf_flow_table: make flow_offload_dead inline + +It is too trivial to keep as a separate exported function + +Signed-off-by: Felix Fietkau <nbd@nbd.name> +--- + +--- a/include/net/netfilter/nf_flow_table.h ++++ b/include/net/netfilter/nf_flow_table.h +@@ -103,7 +103,10 @@ void nf_flow_table_cleanup(struct net *n + int nf_flow_table_init(struct nf_flowtable *flow_table); + void nf_flow_table_free(struct nf_flowtable *flow_table); + +-void flow_offload_dead(struct flow_offload *flow); ++static inline void flow_offload_dead(struct flow_offload *flow) ++{ ++ flow->flags |= FLOW_OFFLOAD_DYING; ++} + + int nf_flow_snat_port(const struct flow_offload *flow, + struct sk_buff *skb, unsigned int thoff, +--- a/net/netfilter/nf_flow_table_core.c ++++ b/net/netfilter/nf_flow_table_core.c +@@ -113,12 +113,6 @@ void flow_offload_free(struct flow_offlo + } + EXPORT_SYMBOL_GPL(flow_offload_free); + +-void flow_offload_dead(struct flow_offload *flow) +-{ +- flow->flags |= FLOW_OFFLOAD_DYING; +-} +-EXPORT_SYMBOL_GPL(flow_offload_dead); +- + static u32 flow_offload_hash(const void *data, u32 len, u32 seed) + { + const struct flow_offload_tuple *tuple = data; diff --git a/target/linux/generic/backport-4.19/361-v4.18-netfilter-nf_flow_table-add-a-new-flow-state-for-tea.patch b/target/linux/generic/backport-4.19/361-v4.18-netfilter-nf_flow_table-add-a-new-flow-state-for-tea.patch new file mode 100644 index 0000000000..30cebfac60 --- /dev/null +++ b/target/linux/generic/backport-4.19/361-v4.18-netfilter-nf_flow_table-add-a-new-flow-state-for-tea.patch @@ -0,0 +1,83 @@ +From: Felix Fietkau <nbd@nbd.name> +Date: Sun, 25 Feb 2018 15:38:31 +0100 +Subject: [PATCH] netfilter: nf_flow_table: add a new flow state for + tearing down offloading + +Will be used to tear down the offload entry while keeping the conntrack +entry alive. + +Signed-off-by: Felix Fietkau <nbd@nbd.name> +--- + +--- a/include/net/netfilter/nf_flow_table.h ++++ b/include/net/netfilter/nf_flow_table.h +@@ -68,6 +68,7 @@ struct flow_offload_tuple_rhash { + #define FLOW_OFFLOAD_SNAT 0x1 + #define FLOW_OFFLOAD_DNAT 0x2 + #define FLOW_OFFLOAD_DYING 0x4 ++#define FLOW_OFFLOAD_TEARDOWN 0x8 + + struct flow_offload { + struct flow_offload_tuple_rhash tuplehash[FLOW_OFFLOAD_DIR_MAX]; +@@ -103,6 +104,7 @@ void nf_flow_table_cleanup(struct net *n + int nf_flow_table_init(struct nf_flowtable *flow_table); + void nf_flow_table_free(struct nf_flowtable *flow_table); + ++void flow_offload_teardown(struct flow_offload *flow); + static inline void flow_offload_dead(struct flow_offload *flow) + { + flow->flags |= FLOW_OFFLOAD_DYING; +--- a/net/netfilter/nf_flow_table_core.c ++++ b/net/netfilter/nf_flow_table_core.c +@@ -174,6 +174,12 @@ static void flow_offload_del(struct nf_f + flow_offload_free(flow); + } + ++void flow_offload_teardown(struct flow_offload *flow) ++{ ++ flow->flags |= FLOW_OFFLOAD_TEARDOWN; ++} ++EXPORT_SYMBOL_GPL(flow_offload_teardown); ++ + struct flow_offload_tuple_rhash * + flow_offload_lookup(struct nf_flowtable *flow_table, + struct flow_offload_tuple *tuple) +@@ -226,11 +232,6 @@ static inline bool nf_flow_has_expired(c + return (__s32)(flow->timeout - (u32)jiffies) <= 0; + } + +-static inline bool nf_flow_is_dying(const struct flow_offload *flow) +-{ +- return flow->flags & FLOW_OFFLOAD_DYING; +-} +- + static int nf_flow_offload_gc_step(struct nf_flowtable *flow_table) + { + struct flow_offload_tuple_rhash *tuplehash; +@@ -258,7 +259,8 @@ static int nf_flow_offload_gc_step(struc + flow = container_of(tuplehash, struct flow_offload, tuplehash[0]); + + if (nf_flow_has_expired(flow) || +- nf_flow_is_dying(flow)) ++ (flow->flags & (FLOW_OFFLOAD_DYING | ++ FLOW_OFFLOAD_TEARDOWN))) + flow_offload_del(flow_table, flow); + } + out: +@@ -419,10 +421,14 @@ static void nf_flow_table_do_cleanup(str + { + struct net_device *dev = data; + +- if (dev && flow->tuplehash[0].tuple.iifidx != dev->ifindex) ++ if (!dev) { ++ flow_offload_teardown(flow); + return; ++ } + +- flow_offload_dead(flow); ++ if (flow->tuplehash[0].tuple.iifidx == dev->ifindex || ++ flow->tuplehash[1].tuple.iifidx == dev->ifindex) ++ flow_offload_dead(flow); + } + + static void nf_flow_table_iterate_cleanup(struct nf_flowtable *flowtable, diff --git a/target/linux/generic/backport-4.19/362-v4.18-netfilter-nf_flow_table-in-flow_offload_lookup-skip-.patch b/target/linux/generic/backport-4.19/362-v4.18-netfilter-nf_flow_table-in-flow_offload_lookup-skip-.patch new file mode 100644 index 0000000000..d14ac97a59 --- /dev/null +++ b/target/linux/generic/backport-4.19/362-v4.18-netfilter-nf_flow_table-in-flow_offload_lookup-skip-.patch @@ -0,0 +1,36 @@ +From: Felix Fietkau <nbd@nbd.name> +Date: Sun, 25 Feb 2018 15:39:56 +0100 +Subject: [PATCH] netfilter: nf_flow_table: in flow_offload_lookup, skip + entries being deleted + +Preparation for sending flows back to the slow path + +Signed-off-by: Felix Fietkau <nbd@nbd.name> +--- + +--- a/net/netfilter/nf_flow_table_core.c ++++ b/net/netfilter/nf_flow_table_core.c +@@ -184,8 +184,21 @@ struct flow_offload_tuple_rhash * + flow_offload_lookup(struct nf_flowtable *flow_table, + struct flow_offload_tuple *tuple) + { +- return rhashtable_lookup_fast(&flow_table->rhashtable, tuple, +- nf_flow_offload_rhash_params); ++ struct flow_offload_tuple_rhash *tuplehash; ++ struct flow_offload *flow; ++ int dir; ++ ++ tuplehash = rhashtable_lookup_fast(&flow_table->rhashtable, tuple, ++ nf_flow_offload_rhash_params); ++ if (!tuplehash) ++ return NULL; ++ ++ dir = tuplehash->tuple.dir; ++ flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]); ++ if (flow->flags & (FLOW_OFFLOAD_DYING | FLOW_OFFLOAD_TEARDOWN)) ++ return NULL; ++ ++ return tuplehash; + } + EXPORT_SYMBOL_GPL(flow_offload_lookup); + diff --git a/target/linux/generic/backport-4.19/363-v4.18-netfilter-nf_flow_table-add-support-for-sending-flow.patch b/target/linux/generic/backport-4.19/363-v4.18-netfilter-nf_flow_table-add-support-for-sending-flow.patch new file mode 100644 index 0000000000..905880fead --- /dev/null +++ b/target/linux/generic/backport-4.19/363-v4.18-netfilter-nf_flow_table-add-support-for-sending-flow.patch @@ -0,0 +1,99 @@ +From: Felix Fietkau <nbd@nbd.name> +Date: Sun, 25 Feb 2018 15:41:11 +0100 +Subject: [PATCH] netfilter: nf_flow_table: add support for sending flows + back to the slow path + +Reset the timeout. For TCP, also set the state to indicate to use the +next incoming packets to reset window tracking. +This allows the slow path to take over again once the offload state has +been torn down + +Signed-off-by: Felix Fietkau <nbd@nbd.name> +--- + +--- a/net/netfilter/nf_flow_table_core.c ++++ b/net/netfilter/nf_flow_table_core.c +@@ -100,6 +100,43 @@ err_ct_refcnt: + } + EXPORT_SYMBOL_GPL(flow_offload_alloc); + ++static void flow_offload_fixup_tcp(struct ip_ct_tcp *tcp) ++{ ++ tcp->state = TCP_CONNTRACK_ESTABLISHED; ++ tcp->seen[0].td_maxwin = 0; ++ tcp->seen[1].td_maxwin = 0; ++} ++ ++static void flow_offload_fixup_ct_state(struct nf_conn *ct) ++{ ++ const struct nf_conntrack_l4proto *l4proto; ++ struct net *net = nf_ct_net(ct); ++ unsigned int *timeouts; ++ unsigned int timeout; ++ int l4num; ++ ++ l4num = nf_ct_protonum(ct); ++ if (l4num == IPPROTO_TCP) ++ flow_offload_fixup_tcp(&ct->proto.tcp); ++ ++ l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), l4num); ++ if (!l4proto) ++ return; ++ ++ timeouts = l4proto->get_timeouts(net); ++ if (!timeouts) ++ return; ++ ++ if (l4num == IPPROTO_TCP) ++ timeout = timeouts[TCP_CONNTRACK_ESTABLISHED]; ++ else if (l4num == IPPROTO_UDP) ++ timeout = timeouts[UDP_CT_REPLIED]; ++ else ++ return; ++ ++ ct->timeout = nfct_time_stamp + timeout; ++} ++ + void flow_offload_free(struct flow_offload *flow) + { + struct flow_offload_entry *e; +@@ -107,7 +144,8 @@ void flow_offload_free(struct flow_offlo + dst_release(flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_cache); + dst_release(flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_cache); + e = container_of(flow, struct flow_offload_entry, flow); +- nf_ct_delete(e->ct, 0, 0); ++ if (flow->flags & FLOW_OFFLOAD_DYING) ++ nf_ct_delete(e->ct, 0, 0); + nf_ct_put(e->ct); + kfree_rcu(e, rcu_head); + } +@@ -164,6 +202,8 @@ EXPORT_SYMBOL_GPL(flow_offload_add); + static void flow_offload_del(struct nf_flowtable *flow_table, + struct flow_offload *flow) + { ++ struct flow_offload_entry *e; ++ + rhashtable_remove_fast(&flow_table->rhashtable, + &flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].node, + nf_flow_offload_rhash_params); +@@ -171,12 +211,20 @@ static void flow_offload_del(struct nf_f + &flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].node, + nf_flow_offload_rhash_params); + ++ e = container_of(flow, struct flow_offload_entry, flow); ++ clear_bit(IPS_OFFLOAD_BIT, &e->ct->status); ++ + flow_offload_free(flow); + } + + void flow_offload_teardown(struct flow_offload *flow) + { ++ struct flow_offload_entry *e; ++ + flow->flags |= FLOW_OFFLOAD_TEARDOWN; ++ ++ e = container_of(flow, struct flow_offload_entry, flow); ++ flow_offload_fixup_ct_state(e->ct); + } + EXPORT_SYMBOL_GPL(flow_offload_teardown); + diff --git a/target/linux/generic/backport-4.19/364-v4.18-netfilter-nf_flow_table-tear-down-TCP-flows-if-RST-o.patch b/target/linux/generic/backport-4.19/364-v4.18-netfilter-nf_flow_table-tear-down-TCP-flows-if-RST-o.patch new file mode 100644 index 0000000000..8b0024cd8d --- /dev/null +++ b/target/linux/generic/backport-4.19/364-v4.18-netfilter-nf_flow_table-tear-down-TCP-flows-if-RST-o.patch @@ -0,0 +1,81 @@ +From: Felix Fietkau <nbd@nbd.name> +Date: Sun, 25 Feb 2018 15:42:58 +0100 +Subject: [PATCH] netfilter: nf_flow_table: tear down TCP flows if RST or + FIN was seen + +Allow the slow path to handle the shutdown of the connection with proper +timeouts + +Signed-off-by: Felix Fietkau <nbd@nbd.name> +--- + +--- a/net/netfilter/nf_flow_table_ip.c ++++ b/net/netfilter/nf_flow_table_ip.c +@@ -15,6 +15,23 @@ + #include <linux/tcp.h> + #include <linux/udp.h> + ++static int nf_flow_tcp_state_check(struct flow_offload *flow, ++ struct sk_buff *skb, unsigned int thoff) ++{ ++ struct tcphdr *tcph; ++ ++ if (!pskb_may_pull(skb, thoff + sizeof(*tcph))) ++ return -1; ++ ++ tcph = (void *)(skb_network_header(skb) + thoff); ++ if (unlikely(tcph->fin || tcph->rst)) { ++ flow_offload_teardown(flow); ++ return -1; ++ } ++ ++ return 0; ++} ++ + static int nf_flow_nat_ip_tcp(struct sk_buff *skb, unsigned int thoff, + __be32 addr, __be32 new_addr) + { +@@ -118,10 +135,9 @@ static int nf_flow_dnat_ip(const struct + } + + static int nf_flow_nat_ip(const struct flow_offload *flow, struct sk_buff *skb, +- enum flow_offload_tuple_dir dir) ++ unsigned int thoff, enum flow_offload_tuple_dir dir) + { + struct iphdr *iph = ip_hdr(skb); +- unsigned int thoff = iph->ihl * 4; + + if (flow->flags & FLOW_OFFLOAD_SNAT && + (nf_flow_snat_port(flow, skb, thoff, iph->protocol, dir) < 0 || +@@ -201,6 +217,7 @@ nf_flow_offload_ip_hook(void *priv, stru + struct flow_offload *flow; + struct net_device *outdev; + const struct rtable *rt; ++ unsigned int thoff; + struct iphdr *iph; + __be32 nexthop; + +@@ -229,8 +246,12 @@ nf_flow_offload_ip_hook(void *priv, stru + if (skb_try_make_writable(skb, sizeof(*iph))) + return NF_DROP; + ++ thoff = ip_hdr(skb)->ihl * 4; ++ if (nf_flow_tcp_state_check(flow, skb, thoff)) ++ return NF_ACCEPT; ++ + if (flow->flags & (FLOW_OFFLOAD_SNAT | FLOW_OFFLOAD_DNAT) && +- nf_flow_nat_ip(flow, skb, dir) < 0) ++ nf_flow_nat_ip(flow, skb, thoff, dir) < 0) + return NF_DROP; + + flow->timeout = (u32)jiffies + NF_FLOW_TIMEOUT; +@@ -438,6 +459,9 @@ nf_flow_offload_ipv6_hook(void *priv, st + if (unlikely(nf_flow_exceeds_mtu(skb, flow->tuplehash[dir].tuple.mtu))) + return NF_ACCEPT; + ++ if (nf_flow_tcp_state_check(flow, skb, sizeof(*ip6h))) ++ return NF_ACCEPT; ++ + if (skb_try_make_writable(skb, sizeof(*ip6h))) + return NF_DROP; + diff --git a/target/linux/generic/backport-4.19/365-v4.16-netfilter-nf_flow_table-fix-checksum-when-handling-D.patch b/target/linux/generic/backport-4.19/365-v4.16-netfilter-nf_flow_table-fix-checksum-when-handling-D.patch new file mode 100644 index 0000000000..372c8d59ef --- /dev/null +++ b/target/linux/generic/backport-4.19/365-v4.16-netfilter-nf_flow_table-fix-checksum-when-handling-D.patch @@ -0,0 +1,19 @@ +From: Felix Fietkau <nbd@nbd.name> +Date: Sun, 25 Feb 2018 17:22:55 +0100 +Subject: [PATCH] netfilter: nf_flow_table: fix checksum when handling DNAT + +Add a missing call to csum_replace4 like on SNAT + +Signed-off-by: Felix Fietkau <nbd@nbd.name> +--- + +--- a/net/netfilter/nf_flow_table_ip.c ++++ b/net/netfilter/nf_flow_table_ip.c +@@ -130,6 +130,7 @@ static int nf_flow_dnat_ip(const struct + default: + return -1; + } ++ csum_replace4(&iph->check, addr, new_addr); + + return nf_flow_nat_ip_l4proto(skb, iph, thoff, addr, new_addr); + } diff --git a/target/linux/generic/backport-4.19/366-netfilter-nf_flow_table-clean-up-and-fix-dst-handlin.patch b/target/linux/generic/backport-4.19/366-netfilter-nf_flow_table-clean-up-and-fix-dst-handlin.patch new file mode 100644 index 0000000000..491f057858 --- /dev/null +++ b/target/linux/generic/backport-4.19/366-netfilter-nf_flow_table-clean-up-and-fix-dst-handlin.patch @@ -0,0 +1,89 @@ +From: Felix Fietkau <nbd@nbd.name> +Date: Thu, 15 Mar 2018 18:21:43 +0100 +Subject: [PATCH] netfilter: nf_flow_table: clean up and fix dst handling + +dst handling in the code is inconsistent and possibly wrong. In my test, +skb_dst(skb) holds the dst entry after routing but before NAT, so the +code could possibly return the same dst entry for both directions of a +connection. +Additionally, there was some confusion over the dst entry vs the address +passed as parameter to rt_nexthop/rt6_nexthop. + +Do an explicit dst lookup for both ends of the connection and always use +the source address for it. When running the IP hook, use the dst entry +for the opposite direction for determining the route. + +Signed-off-by: Felix Fietkau <nbd@nbd.name> +--- + +--- a/net/netfilter/nf_flow_table_ip.c ++++ b/net/netfilter/nf_flow_table_ip.c +@@ -238,7 +238,7 @@ nf_flow_offload_ip_hook(void *priv, stru + + dir = tuplehash->tuple.dir; + flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]); +- rt = (const struct rtable *)flow->tuplehash[dir].tuple.dst_cache; ++ rt = (const struct rtable *)flow->tuplehash[!dir].tuple.dst_cache; + + if (unlikely(nf_flow_exceeds_mtu(skb, flow->tuplehash[dir].tuple.mtu)) && + (ip_hdr(skb)->frag_off & htons(IP_DF)) != 0) +@@ -455,7 +455,7 @@ nf_flow_offload_ipv6_hook(void *priv, st + + dir = tuplehash->tuple.dir; + flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]); +- rt = (struct rt6_info *)flow->tuplehash[dir].tuple.dst_cache; ++ rt = (struct rt6_info *)flow->tuplehash[!dir].tuple.dst_cache; + + if (unlikely(nf_flow_exceeds_mtu(skb, flow->tuplehash[dir].tuple.mtu))) + return NF_ACCEPT; +--- a/net/netfilter/nft_flow_offload.c ++++ b/net/netfilter/nft_flow_offload.c +@@ -17,27 +17,38 @@ struct nft_flow_offload { + struct nft_flowtable *flowtable; + }; + +-static int nft_flow_route(const struct nft_pktinfo *pkt, +- const struct nf_conn *ct, +- struct nf_flow_route *route, +- enum ip_conntrack_dir dir) ++static struct dst_entry * ++nft_flow_dst(const struct nf_conn *ct, enum ip_conntrack_dir dir, ++ const struct nft_pktinfo *pkt) + { +- struct dst_entry *this_dst = skb_dst(pkt->skb); +- struct dst_entry *other_dst = NULL; ++ struct dst_entry *dst; + struct flowi fl; + + memset(&fl, 0, sizeof(fl)); + switch (nft_pf(pkt)) { + case NFPROTO_IPV4: +- fl.u.ip4.daddr = ct->tuplehash[!dir].tuple.dst.u3.ip; ++ fl.u.ip4.daddr = ct->tuplehash[dir].tuple.src.u3.ip; + break; + case NFPROTO_IPV6: +- fl.u.ip6.daddr = ct->tuplehash[!dir].tuple.dst.u3.in6; ++ fl.u.ip6.daddr = ct->tuplehash[dir].tuple.src.u3.in6; + break; + } + +- nf_route(nft_net(pkt), &other_dst, &fl, false, nft_pf(pkt)); +- if (!other_dst) ++ nf_route(nft_net(pkt), &dst, &fl, false, nft_pf(pkt)); ++ ++ return dst; ++} ++ ++static int nft_flow_route(const struct nft_pktinfo *pkt, ++ const struct nf_conn *ct, ++ struct nf_flow_route *route, ++ enum ip_conntrack_dir dir) ++{ ++ struct dst_entry *this_dst, *other_dst; ++ ++ this_dst = nft_flow_dst(ct, dir, pkt); ++ other_dst = nft_flow_dst(ct, !dir, pkt); ++ if (!this_dst || !other_dst) + return -ENOENT; + + route->tuple[dir].dst = this_dst; diff --git a/target/linux/generic/backport-4.19/367-v4.18-netfilter-nf_flow_table-add-missing-condition-for-TC.patch b/target/linux/generic/backport-4.19/367-v4.18-netfilter-nf_flow_table-add-missing-condition-for-TC.patch new file mode 100644 index 0000000000..2a470f77e3 --- /dev/null +++ b/target/linux/generic/backport-4.19/367-v4.18-netfilter-nf_flow_table-add-missing-condition-for-TC.patch @@ -0,0 +1,48 @@ +From: Felix Fietkau <nbd@nbd.name> +Date: Fri, 23 Mar 2018 17:15:22 +0100 +Subject: [PATCH] netfilter: nf_flow_table: add missing condition for TCP state + check + +Avoid looking at unrelated fields in UDP packets + +Signed-off-by: Felix Fietkau <nbd@nbd.name> +--- + +--- a/net/netfilter/nf_flow_table_ip.c ++++ b/net/netfilter/nf_flow_table_ip.c +@@ -15,11 +15,14 @@ + #include <linux/tcp.h> + #include <linux/udp.h> + +-static int nf_flow_tcp_state_check(struct flow_offload *flow, +- struct sk_buff *skb, unsigned int thoff) ++static int nf_flow_state_check(struct flow_offload *flow, int proto, ++ struct sk_buff *skb, unsigned int thoff) + { + struct tcphdr *tcph; + ++ if (proto != IPPROTO_TCP) ++ return 0; ++ + if (!pskb_may_pull(skb, thoff + sizeof(*tcph))) + return -1; + +@@ -248,7 +251,7 @@ nf_flow_offload_ip_hook(void *priv, stru + return NF_DROP; + + thoff = ip_hdr(skb)->ihl * 4; +- if (nf_flow_tcp_state_check(flow, skb, thoff)) ++ if (nf_flow_state_check(flow, ip_hdr(skb)->protocol, skb, thoff)) + return NF_ACCEPT; + + if (flow->flags & (FLOW_OFFLOAD_SNAT | FLOW_OFFLOAD_DNAT) && +@@ -460,7 +463,8 @@ nf_flow_offload_ipv6_hook(void *priv, st + if (unlikely(nf_flow_exceeds_mtu(skb, flow->tuplehash[dir].tuple.mtu))) + return NF_ACCEPT; + +- if (nf_flow_tcp_state_check(flow, skb, sizeof(*ip6h))) ++ if (nf_flow_state_check(flow, ipv6_hdr(skb)->nexthdr, skb, ++ sizeof(*ip6h))) + return NF_ACCEPT; + + if (skb_try_make_writable(skb, sizeof(*ip6h))) diff --git a/target/linux/generic/backport-4.19/368-v4.18-netfilter-nf_flow_table-fix-offloading-connections-w.patch b/target/linux/generic/backport-4.19/368-v4.18-netfilter-nf_flow_table-fix-offloading-connections-w.patch new file mode 100644 index 0000000000..f3d83a1536 --- /dev/null +++ b/target/linux/generic/backport-4.19/368-v4.18-netfilter-nf_flow_table-fix-offloading-connections-w.patch @@ -0,0 +1,23 @@ +From: Felix Fietkau <nbd@nbd.name> +Date: Fri, 23 Mar 2018 19:12:30 +0100 +Subject: [PATCH] netfilter: nf_flow_table: fix offloading connections with + SNAT+DNAT + +Pass all NAT types to the flow offload struct, otherwise parts of the +address/port pair do not get translated properly, causing connection +stalls + +Signed-off-by: Felix Fietkau <nbd@nbd.name> +--- + +--- a/net/netfilter/nf_flow_table_core.c ++++ b/net/netfilter/nf_flow_table_core.c +@@ -84,7 +84,7 @@ flow_offload_alloc(struct nf_conn *ct, s + + if (ct->status & IPS_SRC_NAT) + flow->flags |= FLOW_OFFLOAD_SNAT; +- else if (ct->status & IPS_DST_NAT) ++ if (ct->status & IPS_DST_NAT) + flow->flags |= FLOW_OFFLOAD_DNAT; + + return flow; diff --git a/target/linux/generic/backport-4.19/369-v4.18-netfilter-nf_flow_table-attach-dst-to-skbs.patch b/target/linux/generic/backport-4.19/369-v4.18-netfilter-nf_flow_table-attach-dst-to-skbs.patch new file mode 100644 index 0000000000..35d099097a --- /dev/null +++ b/target/linux/generic/backport-4.19/369-v4.18-netfilter-nf_flow_table-attach-dst-to-skbs.patch @@ -0,0 +1,49 @@ +From: "Jason A. Donenfeld" <Jason@zx2c4.com> +Date: Wed, 30 May 2018 20:43:15 +0200 +Subject: [PATCH] netfilter: nf_flow_table: attach dst to skbs + +Some drivers, such as vxlan and wireguard, use the skb's dst in order to +determine things like PMTU. They therefore loose functionality when flow +offloading is enabled. So, we ensure the skb has it before xmit'ing it +in the offloading path. + +Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + +--- a/net/netfilter/nf_flow_table_ip.c ++++ b/net/netfilter/nf_flow_table_ip.c +@@ -220,7 +220,7 @@ nf_flow_offload_ip_hook(void *priv, stru + enum flow_offload_tuple_dir dir; + struct flow_offload *flow; + struct net_device *outdev; +- const struct rtable *rt; ++ struct rtable *rt; + unsigned int thoff; + struct iphdr *iph; + __be32 nexthop; +@@ -241,7 +241,7 @@ nf_flow_offload_ip_hook(void *priv, stru + + dir = tuplehash->tuple.dir; + flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]); +- rt = (const struct rtable *)flow->tuplehash[!dir].tuple.dst_cache; ++ rt = (struct rtable *)flow->tuplehash[!dir].tuple.dst_cache; + + if (unlikely(nf_flow_exceeds_mtu(skb, flow->tuplehash[dir].tuple.mtu)) && + (ip_hdr(skb)->frag_off & htons(IP_DF)) != 0) +@@ -264,6 +264,7 @@ nf_flow_offload_ip_hook(void *priv, stru + + skb->dev = outdev; + nexthop = rt_nexthop(rt, flow->tuplehash[!dir].tuple.src_v4.s_addr); ++ skb_dst_set_noref(skb, &rt->dst); + neigh_xmit(NEIGH_ARP_TABLE, outdev, &nexthop, skb); + + return NF_STOLEN; +@@ -480,6 +481,7 @@ nf_flow_offload_ipv6_hook(void *priv, st + + skb->dev = outdev; + nexthop = rt6_nexthop(rt, &flow->tuplehash[!dir].tuple.src_v6); ++ skb_dst_set_noref(skb, &rt->dst); + neigh_xmit(NEIGH_ND_TABLE, outdev, nexthop, skb); + + return NF_STOLEN; diff --git a/target/linux/generic/backport-4.19/370-netfilter-nf_flow_table-fix-offloaded-connection-tim.patch b/target/linux/generic/backport-4.19/370-netfilter-nf_flow_table-fix-offloaded-connection-tim.patch new file mode 100644 index 0000000000..e17b4b6204 --- /dev/null +++ b/target/linux/generic/backport-4.19/370-netfilter-nf_flow_table-fix-offloaded-connection-tim.patch @@ -0,0 +1,110 @@ +From: Felix Fietkau <nbd@nbd.name> +Date: Wed, 13 Jun 2018 12:33:39 +0200 +Subject: [PATCH] netfilter: nf_flow_table: fix offloaded connection timeout + corner case + +The full teardown of offloaded flows is deferred to a gc work item, +however processing of packets by netfilter needs to happen immediately +after a teardown is requested, because the conntrack state needs to be +fixed up. + +Since the IPS_OFFLOAD_BIT is still kept until the teardown is complete, +the netfilter conntrack gc can accidentally bump the timeout of a +connection where offload was just stopped, causing a conntrack entry +leak. + +Fix this by moving the conntrack timeout bumping from conntrack core to +the nf_flow_offload and add a check to prevent bogus timeout bumps. + +Signed-off-by: Felix Fietkau <nbd@nbd.name> +--- + +--- a/net/netfilter/nf_conntrack_core.c ++++ b/net/netfilter/nf_conntrack_core.c +@@ -981,18 +981,6 @@ static bool gc_worker_can_early_drop(con + return false; + } + +-#define DAY (86400 * HZ) +- +-/* Set an arbitrary timeout large enough not to ever expire, this save +- * us a check for the IPS_OFFLOAD_BIT from the packet path via +- * nf_ct_is_expired(). +- */ +-static void nf_ct_offload_timeout(struct nf_conn *ct) +-{ +- if (nf_ct_expires(ct) < DAY / 2) +- ct->timeout = nfct_time_stamp + DAY; +-} +- + static void gc_worker(struct work_struct *work) + { + unsigned int min_interval = max(HZ / GC_MAX_BUCKETS_DIV, 1u); +@@ -1029,10 +1017,8 @@ static void gc_worker(struct work_struct + tmp = nf_ct_tuplehash_to_ctrack(h); + + scanned++; +- if (test_bit(IPS_OFFLOAD_BIT, &tmp->status)) { +- nf_ct_offload_timeout(tmp); ++ if (test_bit(IPS_OFFLOAD_BIT, &tmp->status)) + continue; +- } + + if (nf_ct_is_expired(tmp)) { + nf_ct_gc_expired(tmp); +--- a/net/netfilter/nf_flow_table_core.c ++++ b/net/netfilter/nf_flow_table_core.c +@@ -185,8 +185,27 @@ static const struct rhashtable_params nf + .automatic_shrinking = true, + }; + ++#define DAY (86400 * HZ) ++ ++/* Set an arbitrary timeout large enough not to ever expire, this save ++ * us a check for the IPS_OFFLOAD_BIT from the packet path via ++ * nf_ct_is_expired(). ++ */ ++static void nf_ct_offload_timeout(struct flow_offload *flow) ++{ ++ struct flow_offload_entry *entry; ++ struct nf_conn *ct; ++ ++ entry = container_of(flow, struct flow_offload_entry, flow); ++ ct = entry->ct; ++ ++ if (nf_ct_expires(ct) < DAY / 2) ++ ct->timeout = nfct_time_stamp + DAY; ++} ++ + int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow) + { ++ nf_ct_offload_timeout(flow); + flow->timeout = (u32)jiffies; + + rhashtable_insert_fast(&flow_table->rhashtable, +@@ -307,6 +326,8 @@ static int nf_flow_offload_gc_step(struc + rhashtable_walk_start(&hti); + + while ((tuplehash = rhashtable_walk_next(&hti))) { ++ bool teardown; ++ + if (IS_ERR(tuplehash)) { + err = PTR_ERR(tuplehash); + if (err != -EAGAIN) +@@ -319,9 +340,13 @@ static int nf_flow_offload_gc_step(struc + + flow = container_of(tuplehash, struct flow_offload, tuplehash[0]); + +- if (nf_flow_has_expired(flow) || +- (flow->flags & (FLOW_OFFLOAD_DYING | +- FLOW_OFFLOAD_TEARDOWN))) ++ teardown = flow->flags & (FLOW_OFFLOAD_DYING | ++ FLOW_OFFLOAD_TEARDOWN); ++ ++ if (!teardown) ++ nf_ct_offload_timeout(flow); ++ ++ if (nf_flow_has_expired(flow) || teardown) + flow_offload_del(flow_table, flow); + } + out: diff --git a/target/linux/generic/backport-4.19/371-netfilter-nf_flow_table-fix-up-ct-state-of-flows-aft.patch b/target/linux/generic/backport-4.19/371-netfilter-nf_flow_table-fix-up-ct-state-of-flows-aft.patch new file mode 100644 index 0000000000..fb14a284ae --- /dev/null +++ b/target/linux/generic/backport-4.19/371-netfilter-nf_flow_table-fix-up-ct-state-of-flows-aft.patch @@ -0,0 +1,24 @@ +From: Felix Fietkau <nbd@nbd.name> +Date: Thu, 14 Jun 2018 11:20:09 +0200 +Subject: [PATCH] netfilter: nf_flow_table: fix up ct state of flows after + timeout + +If a connection simply times out instead of being torn down, it is left +active with a long timeout. Fix this by calling flow_offload_fixup_ct_state +here as well. + +Signed-off-by: Felix Fietkau <nbd@nbd.name> +--- + +--- a/net/netfilter/nf_flow_table_core.c ++++ b/net/netfilter/nf_flow_table_core.c +@@ -233,6 +233,9 @@ static void flow_offload_del(struct nf_f + e = container_of(flow, struct flow_offload_entry, flow); + clear_bit(IPS_OFFLOAD_BIT, &e->ct->status); + ++ if (!(flow->flags & FLOW_OFFLOAD_TEARDOWN)) ++ flow_offload_fixup_ct_state(e->ct); ++ + flow_offload_free(flow); + } + diff --git a/target/linux/generic/backport-4.19/400-v4.16-leds-trigger-Introduce-a-NETDEV-trigger.patch b/target/linux/generic/backport-4.19/400-v4.16-leds-trigger-Introduce-a-NETDEV-trigger.patch new file mode 100644 index 0000000000..b7d680a11b --- /dev/null +++ b/target/linux/generic/backport-4.19/400-v4.16-leds-trigger-Introduce-a-NETDEV-trigger.patch @@ -0,0 +1,588 @@ +From 06f502f57d0d7728f9fa0f157ec5e4111ddb98f6 Mon Sep 17 00:00:00 2001 +From: Ben Whitten <ben.whitten@gmail.com> +Date: Sun, 10 Dec 2017 21:17:55 +0000 +Subject: [PATCH] leds: trigger: Introduce a NETDEV trigger + +This commit introduces a NETDEV trigger for named device +activity. Available triggers are link, rx, and tx. + +Signed-off-by: Ben Whitten <ben.whitten@gmail.com> +Acked-by: Pavel Machek <pavel@ucw.cz> +Signed-off-by: Jacek Anaszewski <jacek.anaszewski@gmail.com> +--- + .../ABI/testing/sysfs-class-led-trigger-netdev | 45 ++ + drivers/leds/trigger/Kconfig | 7 + + drivers/leds/trigger/Makefile | 1 + + drivers/leds/trigger/ledtrig-netdev.c | 496 +++++++++++++++++++++ + 4 files changed, 549 insertions(+) + create mode 100644 Documentation/ABI/testing/sysfs-class-led-trigger-netdev + create mode 100644 drivers/leds/trigger/ledtrig-netdev.c + +--- /dev/null ++++ b/Documentation/ABI/testing/sysfs-class-led-trigger-netdev +@@ -0,0 +1,45 @@ ++What: /sys/class/leds/<led>/device_name ++Date: Dec 2017 ++KernelVersion: 4.16 ++Contact: linux-leds@vger.kernel.org ++Description: ++ Specifies the network device name to monitor. ++ ++What: /sys/class/leds/<led>/interval ++Date: Dec 2017 ++KernelVersion: 4.16 ++Contact: linux-leds@vger.kernel.org ++Description: ++ Specifies the duration of the LED blink in milliseconds. ++ Defaults to 50 ms. ++ ++What: /sys/class/leds/<led>/link ++Date: Dec 2017 ++KernelVersion: 4.16 ++Contact: linux-leds@vger.kernel.org ++Description: ++ Signal the link state of the named network device. ++ If set to 0 (default), the LED's normal state is off. ++ If set to 1, the LED's normal state reflects the link state ++ of the named network device. ++ Setting this value also immediately changes the LED state. ++ ++What: /sys/class/leds/<led>/tx ++Date: Dec 2017 ++KernelVersion: 4.16 ++Contact: linux-leds@vger.kernel.org ++Description: ++ Signal transmission of data on the named network device. ++ If set to 0 (default), the LED will not blink on transmission. ++ If set to 1, the LED will blink for the milliseconds specified ++ in interval to signal transmission. ++ ++What: /sys/class/leds/<led>/rx ++Date: Dec 2017 ++KernelVersion: 4.16 ++Contact: linux-leds@vger.kernel.org ++Description: ++ Signal reception of data on the named network device. ++ If set to 0 (default), the LED will not blink on reception. ++ If set to 1, the LED will blink for the milliseconds specified ++ in interval to signal reception. +--- a/drivers/leds/trigger/Kconfig ++++ b/drivers/leds/trigger/Kconfig +@@ -126,4 +126,11 @@ config LEDS_TRIGGER_PANIC + a different trigger. + If unsure, say Y. + ++config LEDS_TRIGGER_NETDEV ++ tristate "LED Netdev Trigger" ++ depends on NET && LEDS_TRIGGERS ++ help ++ This allows LEDs to be controlled by network device activity. ++ If unsure, say Y. ++ + endif # LEDS_TRIGGERS +--- a/drivers/leds/trigger/Makefile ++++ b/drivers/leds/trigger/Makefile +@@ -11,3 +11,4 @@ obj-$(CONFIG_LEDS_TRIGGER_DEFAULT_ON) += + obj-$(CONFIG_LEDS_TRIGGER_TRANSIENT) += ledtrig-transient.o + obj-$(CONFIG_LEDS_TRIGGER_CAMERA) += ledtrig-camera.o + obj-$(CONFIG_LEDS_TRIGGER_PANIC) += ledtrig-panic.o ++obj-$(CONFIG_LEDS_TRIGGER_NETDEV) += ledtrig-netdev.o +--- /dev/null ++++ b/drivers/leds/trigger/ledtrig-netdev.c +@@ -0,0 +1,496 @@ ++// SPDX-License-Identifier: GPL-2.0 ++// Copyright 2017 Ben Whitten <ben.whitten@gmail.com> ++// Copyright 2007 Oliver Jowett <oliver@opencloud.com> ++// ++// LED Kernel Netdev Trigger ++// ++// Toggles the LED to reflect the link and traffic state of a named net device ++// ++// Derived from ledtrig-timer.c which is: ++// Copyright 2005-2006 Openedhand Ltd. ++// Author: Richard Purdie <rpurdie@openedhand.com> ++ ++#include <linux/atomic.h> ++#include <linux/ctype.h> ++#include <linux/device.h> ++#include <linux/init.h> ++#include <linux/jiffies.h> ++#include <linux/kernel.h> ++#include <linux/leds.h> ++#include <linux/list.h> ++#include <linux/module.h> ++#include <linux/netdevice.h> ++#include <linux/spinlock.h> ++#include <linux/timer.h> ++#include "../leds.h" ++ ++/* ++ * Configurable sysfs attributes: ++ * ++ * device_name - network device name to monitor ++ * interval - duration of LED blink, in milliseconds ++ * link - LED's normal state reflects whether the link is up ++ * (has carrier) or not ++ * tx - LED blinks on transmitted data ++ * rx - LED blinks on receive data ++ * ++ */ ++ ++struct led_netdev_data { ++ spinlock_t lock; ++ ++ struct delayed_work work; ++ struct notifier_block notifier; ++ ++ struct led_classdev *led_cdev; ++ struct net_device *net_dev; ++ ++ char device_name[IFNAMSIZ]; ++ atomic_t interval; ++ unsigned int last_activity; ++ ++ unsigned long mode; ++#define NETDEV_LED_LINK 0 ++#define NETDEV_LED_TX 1 ++#define NETDEV_LED_RX 2 ++#define NETDEV_LED_MODE_LINKUP 3 ++}; ++ ++enum netdev_led_attr { ++ NETDEV_ATTR_LINK, ++ NETDEV_ATTR_TX, ++ NETDEV_ATTR_RX ++}; ++ ++static void set_baseline_state(struct led_netdev_data *trigger_data) ++{ ++ int current_brightness; ++ struct led_classdev *led_cdev = trigger_data->led_cdev; ++ ++ current_brightness = led_cdev->brightness; ++ if (current_brightness) ++ led_cdev->blink_brightness = current_brightness; ++ if (!led_cdev->blink_brightness) ++ led_cdev->blink_brightness = led_cdev->max_brightness; ++ ++ if (!test_bit(NETDEV_LED_MODE_LINKUP, &trigger_data->mode)) ++ led_set_brightness(led_cdev, LED_OFF); ++ else { ++ if (test_bit(NETDEV_LED_LINK, &trigger_data->mode)) ++ led_set_brightness(led_cdev, ++ led_cdev->blink_brightness); ++ else ++ led_set_brightness(led_cdev, LED_OFF); ++ ++ /* If we are looking for RX/TX start periodically ++ * checking stats ++ */ ++ if (test_bit(NETDEV_LED_TX, &trigger_data->mode) || ++ test_bit(NETDEV_LED_RX, &trigger_data->mode)) ++ schedule_delayed_work(&trigger_data->work, 0); ++ } ++} ++ ++static ssize_t device_name_show(struct device *dev, ++ struct device_attribute *attr, char *buf) ++{ ++ struct led_classdev *led_cdev = dev_get_drvdata(dev); ++ struct led_netdev_data *trigger_data = led_cdev->trigger_data; ++ ssize_t len; ++ ++ spin_lock_bh(&trigger_data->lock); ++ len = sprintf(buf, "%s\n", trigger_data->device_name); ++ spin_unlock_bh(&trigger_data->lock); ++ ++ return len; ++} ++ ++static ssize_t device_name_store(struct device *dev, ++ struct device_attribute *attr, const char *buf, ++ size_t size) ++{ ++ struct led_classdev *led_cdev = dev_get_drvdata(dev); ++ struct led_netdev_data *trigger_data = led_cdev->trigger_data; ++ ++ if (size >= IFNAMSIZ) ++ return -EINVAL; ++ ++ cancel_delayed_work_sync(&trigger_data->work); ++ ++ spin_lock_bh(&trigger_data->lock); ++ ++ if (trigger_data->net_dev) { ++ dev_put(trigger_data->net_dev); ++ trigger_data->net_dev = NULL; ++ } ++ ++ strncpy(trigger_data->device_name, buf, size); ++ if (size > 0 && trigger_data->device_name[size - 1] == '\n') ++ trigger_data->device_name[size - 1] = 0; ++ ++ if (trigger_data->device_name[0] != 0) ++ trigger_data->net_dev = ++ dev_get_by_name(&init_net, trigger_data->device_name); ++ ++ clear_bit(NETDEV_LED_MODE_LINKUP, &trigger_data->mode); ++ if (trigger_data->net_dev != NULL) ++ if (netif_carrier_ok(trigger_data->net_dev)) ++ set_bit(NETDEV_LED_MODE_LINKUP, &trigger_data->mode); ++ ++ trigger_data->last_activity = 0; ++ ++ set_baseline_state(trigger_data); ++ spin_unlock_bh(&trigger_data->lock); ++ ++ return size; ++} ++ ++static DEVICE_ATTR_RW(device_name); ++ ++static ssize_t netdev_led_attr_show(struct device *dev, char *buf, ++ enum netdev_led_attr attr) ++{ ++ struct led_classdev *led_cdev = dev_get_drvdata(dev); ++ struct led_netdev_data *trigger_data = led_cdev->trigger_data; ++ int bit; ++ ++ switch (attr) { ++ case NETDEV_ATTR_LINK: ++ bit = NETDEV_LED_LINK; ++ break; ++ case NETDEV_ATTR_TX: ++ bit = NETDEV_LED_TX; ++ break; ++ case NETDEV_ATTR_RX: ++ bit = NETDEV_LED_RX; ++ break; ++ default: ++ return -EINVAL; ++ } ++ ++ return sprintf(buf, "%u\n", test_bit(bit, &trigger_data->mode)); ++} ++ ++static ssize_t netdev_led_attr_store(struct device *dev, const char *buf, ++ size_t size, enum netdev_led_attr attr) ++{ ++ struct led_classdev *led_cdev = dev_get_drvdata(dev); ++ struct led_netdev_data *trigger_data = led_cdev->trigger_data; ++ unsigned long state; ++ int ret; ++ int bit; ++ ++ ret = kstrtoul(buf, 0, &state); ++ if (ret) ++ return ret; ++ ++ switch (attr) { ++ case NETDEV_ATTR_LINK: ++ bit = NETDEV_LED_LINK; ++ break; ++ case NETDEV_ATTR_TX: ++ bit = NETDEV_LED_TX; ++ break; ++ case NETDEV_ATTR_RX: ++ bit = NETDEV_LED_RX; ++ break; ++ default: ++ return -EINVAL; ++ } ++ ++ cancel_delayed_work_sync(&trigger_data->work); ++ ++ if (state) ++ set_bit(bit, &trigger_data->mode); ++ else ++ clear_bit(bit, &trigger_data->mode); ++ ++ set_baseline_state(trigger_data); ++ ++ return size; ++} ++ ++static ssize_t link_show(struct device *dev, ++ struct device_attribute *attr, char *buf) ++{ ++ return netdev_led_attr_show(dev, buf, NETDEV_ATTR_LINK); ++} ++ ++static ssize_t link_store(struct device *dev, ++ struct device_attribute *attr, const char *buf, size_t size) ++{ ++ return netdev_led_attr_store(dev, buf, size, NETDEV_ATTR_LINK); ++} ++ ++static DEVICE_ATTR_RW(link); ++ ++static ssize_t tx_show(struct device *dev, ++ struct device_attribute *attr, char *buf) ++{ ++ return netdev_led_attr_show(dev, buf, NETDEV_ATTR_TX); ++} ++ ++static ssize_t tx_store(struct device *dev, ++ struct device_attribute *attr, const char *buf, size_t size) ++{ ++ return netdev_led_attr_store(dev, buf, size, NETDEV_ATTR_TX); ++} ++ ++static DEVICE_ATTR_RW(tx); ++ ++static ssize_t rx_show(struct device *dev, ++ struct device_attribute *attr, char *buf) ++{ ++ return netdev_led_attr_show(dev, buf, NETDEV_ATTR_RX); ++} ++ ++static ssize_t rx_store(struct device *dev, ++ struct device_attribute *attr, const char *buf, size_t size) ++{ ++ return netdev_led_attr_store(dev, buf, size, NETDEV_ATTR_RX); ++} ++ ++static DEVICE_ATTR_RW(rx); ++ ++static ssize_t interval_show(struct device *dev, ++ struct device_attribute *attr, char *buf) ++{ ++ struct led_classdev *led_cdev = dev_get_drvdata(dev); ++ struct led_netdev_data *trigger_data = led_cdev->trigger_data; ++ ++ return sprintf(buf, "%u\n", ++ jiffies_to_msecs(atomic_read(&trigger_data->interval))); ++} ++ ++static ssize_t interval_store(struct device *dev, ++ struct device_attribute *attr, const char *buf, ++ size_t size) ++{ ++ struct led_classdev *led_cdev = dev_get_drvdata(dev); ++ struct led_netdev_data *trigger_data = led_cdev->trigger_data; ++ unsigned long value; ++ int ret; ++ ++ ret = kstrtoul(buf, 0, &value); ++ if (ret) ++ return ret; ++ ++ /* impose some basic bounds on the timer interval */ ++ if (value >= 5 && value <= 10000) { ++ cancel_delayed_work_sync(&trigger_data->work); ++ ++ atomic_set(&trigger_data->interval, msecs_to_jiffies(value)); ++ set_baseline_state(trigger_data); /* resets timer */ ++ } ++ ++ return size; ++} ++ ++static DEVICE_ATTR_RW(interval); ++ ++static int netdev_trig_notify(struct notifier_block *nb, ++ unsigned long evt, void *dv) ++{ ++ struct net_device *dev = ++ netdev_notifier_info_to_dev((struct netdev_notifier_info *)dv); ++ struct led_netdev_data *trigger_data = container_of(nb, ++ struct ++ led_netdev_data, ++ notifier); ++ ++ if (evt != NETDEV_UP && evt != NETDEV_DOWN && evt != NETDEV_CHANGE ++ && evt != NETDEV_REGISTER && evt != NETDEV_UNREGISTER ++ && evt != NETDEV_CHANGENAME) ++ return NOTIFY_DONE; ++ ++ if (strcmp(dev->name, trigger_data->device_name)) ++ return NOTIFY_DONE; ++ ++ cancel_delayed_work_sync(&trigger_data->work); ++ ++ spin_lock_bh(&trigger_data->lock); ++ ++ clear_bit(NETDEV_LED_MODE_LINKUP, &trigger_data->mode); ++ switch (evt) { ++ case NETDEV_REGISTER: ++ if (trigger_data->net_dev) ++ dev_put(trigger_data->net_dev); ++ dev_hold(dev); ++ trigger_data->net_dev = dev; ++ break; ++ case NETDEV_CHANGENAME: ++ case NETDEV_UNREGISTER: ++ if (trigger_data->net_dev) { ++ dev_put(trigger_data->net_dev); ++ trigger_data->net_dev = NULL; ++ } ++ break; ++ case NETDEV_UP: ++ case NETDEV_CHANGE: ++ if (netif_carrier_ok(dev)) ++ set_bit(NETDEV_LED_MODE_LINKUP, &trigger_data->mode); ++ break; ++ } ++ ++ set_baseline_state(trigger_data); ++ ++ spin_unlock_bh(&trigger_data->lock); ++ ++ return NOTIFY_DONE; ++} ++ ++/* here's the real work! */ ++static void netdev_trig_work(struct work_struct *work) ++{ ++ struct led_netdev_data *trigger_data = container_of(work, ++ struct ++ led_netdev_data, ++ work.work); ++ struct rtnl_link_stats64 *dev_stats; ++ unsigned int new_activity; ++ struct rtnl_link_stats64 temp; ++ unsigned long interval; ++ int invert; ++ ++ /* If we dont have a device, insure we are off */ ++ if (!trigger_data->net_dev) { ++ led_set_brightness(trigger_data->led_cdev, LED_OFF); ++ return; ++ } ++ ++ /* If we are not looking for RX/TX then return */ ++ if (!test_bit(NETDEV_LED_TX, &trigger_data->mode) && ++ !test_bit(NETDEV_LED_RX, &trigger_data->mode)) ++ return; ++ ++ dev_stats = dev_get_stats(trigger_data->net_dev, &temp); ++ new_activity = ++ (test_bit(NETDEV_LED_TX, &trigger_data->mode) ? ++ dev_stats->tx_packets : 0) + ++ (test_bit(NETDEV_LED_RX, &trigger_data->mode) ? ++ dev_stats->rx_packets : 0); ++ ++ if (trigger_data->last_activity != new_activity) { ++ led_stop_software_blink(trigger_data->led_cdev); ++ ++ invert = test_bit(NETDEV_LED_LINK, &trigger_data->mode); ++ interval = jiffies_to_msecs( ++ atomic_read(&trigger_data->interval)); ++ /* base state is ON (link present) */ ++ led_blink_set_oneshot(trigger_data->led_cdev, ++ &interval, ++ &interval, ++ invert); ++ trigger_data->last_activity = new_activity; ++ } ++ ++ schedule_delayed_work(&trigger_data->work, ++ (atomic_read(&trigger_data->interval)*2)); ++} ++ ++static void netdev_trig_activate(struct led_classdev *led_cdev) ++{ ++ struct led_netdev_data *trigger_data; ++ int rc; ++ ++ trigger_data = kzalloc(sizeof(struct led_netdev_data), GFP_KERNEL); ++ if (!trigger_data) ++ return; ++ ++ spin_lock_init(&trigger_data->lock); ++ ++ trigger_data->notifier.notifier_call = netdev_trig_notify; ++ trigger_data->notifier.priority = 10; ++ ++ INIT_DELAYED_WORK(&trigger_data->work, netdev_trig_work); ++ ++ trigger_data->led_cdev = led_cdev; ++ trigger_data->net_dev = NULL; ++ trigger_data->device_name[0] = 0; ++ ++ trigger_data->mode = 0; ++ atomic_set(&trigger_data->interval, msecs_to_jiffies(50)); ++ trigger_data->last_activity = 0; ++ ++ led_cdev->trigger_data = trigger_data; ++ ++ rc = device_create_file(led_cdev->dev, &dev_attr_device_name); ++ if (rc) ++ goto err_out; ++ rc = device_create_file(led_cdev->dev, &dev_attr_link); ++ if (rc) ++ goto err_out_device_name; ++ rc = device_create_file(led_cdev->dev, &dev_attr_rx); ++ if (rc) ++ goto err_out_link; ++ rc = device_create_file(led_cdev->dev, &dev_attr_tx); ++ if (rc) ++ goto err_out_rx; ++ rc = device_create_file(led_cdev->dev, &dev_attr_interval); ++ if (rc) ++ goto err_out_tx; ++ rc = register_netdevice_notifier(&trigger_data->notifier); ++ if (rc) ++ goto err_out_interval; ++ return; ++ ++err_out_interval: ++ device_remove_file(led_cdev->dev, &dev_attr_interval); ++err_out_tx: ++ device_remove_file(led_cdev->dev, &dev_attr_tx); ++err_out_rx: ++ device_remove_file(led_cdev->dev, &dev_attr_rx); ++err_out_link: ++ device_remove_file(led_cdev->dev, &dev_attr_link); ++err_out_device_name: ++ device_remove_file(led_cdev->dev, &dev_attr_device_name); ++err_out: ++ led_cdev->trigger_data = NULL; ++ kfree(trigger_data); ++} ++ ++static void netdev_trig_deactivate(struct led_classdev *led_cdev) ++{ ++ struct led_netdev_data *trigger_data = led_cdev->trigger_data; ++ ++ if (trigger_data) { ++ unregister_netdevice_notifier(&trigger_data->notifier); ++ ++ device_remove_file(led_cdev->dev, &dev_attr_device_name); ++ device_remove_file(led_cdev->dev, &dev_attr_link); ++ device_remove_file(led_cdev->dev, &dev_attr_rx); ++ device_remove_file(led_cdev->dev, &dev_attr_tx); ++ device_remove_file(led_cdev->dev, &dev_attr_interval); ++ ++ cancel_delayed_work_sync(&trigger_data->work); ++ ++ if (trigger_data->net_dev) ++ dev_put(trigger_data->net_dev); ++ ++ kfree(trigger_data); ++ } ++} ++ ++static struct led_trigger netdev_led_trigger = { ++ .name = "netdev", ++ .activate = netdev_trig_activate, ++ .deactivate = netdev_trig_deactivate, ++}; ++ ++static int __init netdev_trig_init(void) ++{ ++ return led_trigger_register(&netdev_led_trigger); ++} ++ ++static void __exit netdev_trig_exit(void) ++{ ++ led_trigger_unregister(&netdev_led_trigger); ++} ++ ++module_init(netdev_trig_init); ++module_exit(netdev_trig_exit); ++ ++MODULE_AUTHOR("Ben Whitten <ben.whitten@gmail.com>"); ++MODULE_AUTHOR("Oliver Jowett <oliver@opencloud.com>"); ++MODULE_DESCRIPTION("Netdev LED trigger"); ++MODULE_LICENSE("GPL v2"); diff --git a/target/linux/generic/backport-4.19/500-ubifs-Handle-re-linking-of-inodes-correctly-while-re.patch b/target/linux/generic/backport-4.19/500-ubifs-Handle-re-linking-of-inodes-correctly-while-re.patch new file mode 100644 index 0000000000..71e036c920 --- /dev/null +++ b/target/linux/generic/backport-4.19/500-ubifs-Handle-re-linking-of-inodes-correctly-while-re.patch @@ -0,0 +1,89 @@ +From: Richard Weinberger <richard@nod.at> +Date: Wed, 7 Nov 2018 23:04:43 +0100 +Subject: [PATCH] ubifs: Handle re-linking of inodes correctly while recovery +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +UBIFS's recovery code strictly assumes that a deleted inode will never +come back, therefore it removes all data which belongs to that inode +as soon it faces an inode with link count 0 in the replay list. +Before O_TMPFILE this assumption was perfectly fine. With O_TMPFILE +it can lead to data loss upon a power-cut. + +Consider a journal with entries like: +0: inode X (nlink = 0) /* O_TMPFILE was created */ +1: data for inode X /* Someone writes to the temp file */ +2: inode X (nlink = 0) /* inode was changed, xattr, chmod, … */ +3: inode X (nlink = 1) /* inode was re-linked via linkat() */ + +Upon replay of entry #2 UBIFS will drop all data that belongs to inode X, +this will lead to an empty file after mounting. + +As solution for this problem, scan the replay list for a re-link entry +before dropping data. + +Fixes: 474b93704f32 ("ubifs: Implement O_TMPFILE") +Cc: stable@vger.kernel.org +Cc: Russell Senior <russell@personaltelco.net> +Cc: Rafał Miłecki <zajec5@gmail.com> +Reported-by: Russell Senior <russell@personaltelco.net> +Reported-by: Rafał Miłecki <zajec5@gmail.com> +Signed-off-by: Richard Weinberger <richard@nod.at> +--- + fs/ubifs/replay.c | 37 +++++++++++++++++++++++++++++++++++++ + 1 file changed, 37 insertions(+) + +--- a/fs/ubifs/replay.c ++++ b/fs/ubifs/replay.c +@@ -210,6 +210,38 @@ static int trun_remove_range(struct ubif + } + + /** ++ * inode_still_linked - check whether inode in question will be re-linked. ++ * @c: UBIFS file-system description object ++ * @rino: replay entry to test ++ * ++ * O_TMPFILE files can be re-linked, this means link count goes from 0 to 1. ++ * This case needs special care, otherwise all references to the inode will ++ * be removed upon the first replay entry of an inode with link count 0 ++ * is found. ++ */ ++static bool inode_still_linked(struct ubifs_info *c, struct replay_entry *rino) ++{ ++ struct replay_entry *r; ++ ++ ubifs_assert(rino->deletion); ++ ubifs_assert(key_type(c, &rino->key) == UBIFS_INO_KEY); ++ ++ /* ++ * Find the most recent entry for the inode behind @rino and check ++ * whether it is a deletion. ++ */ ++ list_for_each_entry_reverse(r, &c->replay_list, list) { ++ ubifs_assert(r->sqnum >= rino->sqnum); ++ if (key_inum(c, &r->key) == key_inum(c, &rino->key)) ++ return r->deletion == 0; ++ ++ } ++ ++ ubifs_assert(0); ++ return false; ++} ++ ++/** + * apply_replay_entry - apply a replay entry to the TNC. + * @c: UBIFS file-system description object + * @r: replay entry to apply +@@ -239,6 +271,11 @@ static int apply_replay_entry(struct ubi + { + ino_t inum = key_inum(c, &r->key); + ++ if (inode_still_linked(c, r)) { ++ err = 0; ++ break; ++ } ++ + err = ubifs_tnc_remove_ino(c, inum); + break; + } |